DEV Community: Matt Macosko

I Had Three Terminals Open All Day. Now I Have One Window I Can Talk To.

Matt Macosko — Tue, 13 Oct 2026 18:30:12 +0000

🖥️Three terminals, three computers

Most days I have three terminals open, each one a Claude Code session, and they live on three different computers: an M5 MacBook, a Mac mini that stays on all the time, and a Windows PC in the shop. A lot of Divine Tribe, my vape business, gets done through those sessions. Orders, shipping, email, the websites, and the apps I build on the side.

The sessions were fine. The screen was the problem. I’m usually in my browser doing orders on my shop dashboard or reading something, and next to it three windows are cooking and scrolling and asking for things. I wanted all of them tucked into a strip on the side of the screen, about a fifth of it, where I could open one up, tell it what I need, and put it back.

The session list on the left, an open conversation on the right. All the screenshots here come from the demo server with made up sessions, not my real ones.

🙅It doesn’t touch my browser

Before anything got built we made a clickable mockup. The first version had a panel that opened pages for me and a terminal that slid over the browser. I said no to both. The browser is mine and I drive it. Moonstone is only the list of conversations and the conversations themselves, in a window I size myself and park next to everything else.

Sessions are grouped by machine and each machine gets its own color. Whatever is waiting on me floats to the top with a NEEDS YOU tag. When I start a new session it picks the computer for me, skipping anything offline and going to whichever one has the least going on, and I can tap a different machine if I want it somewhere else.

Each machine with its GPU and RAM. The star marks where the next session will start.

⌨️Never read only

The first working version showed the sessions I had started in a regular terminal as read only, so I could watch them but not type into them. That didn’t last. I never just want to watch a session. I want to type into any of them from that one window like I’m sitting at that computer, and I want plain answers back, not the pile of commands and code it took to get there.

So now typing into a terminal session moves the whole conversation into Moonstone with its history and closes the old terminal window. When a session wants to run something, it shows up as a card with Allow and Don’t, and nothing gets approved unless I tap it.

A session asking before it runs a command. Nothing is approved on its own.

🎙️Talking to it with my hands full

A good part of my day is packing orders, and I wanted to talk to my sessions while my hands are full. I already had a voice chat called Ohm that reads its answers out loud, and I liked how that felt. I wanted the same thing here.

Every conversation has a mic button. Tap it, talk, then tap it again or hit Enter and it sends. I tried a couple of other ways to do the listening first and none of them felt as instant as the dictation already built into the computer, so that’s what it uses. On a Mac a little helper app turns on the Mac’s own dictation, and on Windows it presses Win+H. Answers get read back in a Kokoro voice running on my own machine. If I have Moonstone open on two computers at once, only the one I touched last does the talking.

The speaker at the top reads each answer out loud. The green mic means it’s listening.

🧠Local models in the same list

Not every question needs Claude. The same list has local models on it: Qwen 3.8 Heretic and Gemma 4 on the M5, and SuperGemma 4 E4B on the PC. I run them at full precision, never squeezed down, so the PC gets the model that actually fits its 32 GB at full size. A local model that sits idle for 30 minutes shuts itself off and gives the memory back, and it starts up again on the next message.

The transcription and the voice run on my own computers too. Each machine runs the same small server that only listens to itself, and they reach each other over SSH tunnels.

🌙Where it is now

It’s one Node file and one HTML file with no dependencies, and it’s meant to replace the Trinidad Head terminals I’ve been using. The code is on GitHub under the MIT license at nicedreamzapp/moonstone, and there’s a page for it with the setup steps on my software site.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Anthropic’s Biggest Backer Just Killed Its Best Model: The Real Story Behind the Fable 5 Shutdown

Matt Macosko — Tue, 29 Sep 2026 18:30:17 +0000

120,000

Characters of system prompt leaked

90 min

Ultimatum to comply

Days from launch to blackout

⏱️The two-minute version

Anthropic launched Claude Fable 5 and Mythos 5 on June 9, the most capable models they had ever shipped. Three days later, on Friday June 12, both models went dark for every customer on the planet. Not throttled, not regionally blocked. Gone.

The reason everyone first latched onto was a famous jailbreaker named Pliny the Liberator, who cracked the model open within a day and posted its entire 120,000 character system prompt on GitHub. That happened, and it is a great story. But it is not why the model got pulled.

The model got pulled because Amazon picked up the phone.

📰What the reporting actually says

According to the Wall Street Journal, Axios, and The Information, Amazon’s own researchers bypassed Fable 5’s safety guardrails internally. They put together a report showing the model could be guided into finding security vulnerabilities across at least four different software programs, the kind of thing that makes a government nervous.

Then Amazon CEO Andy Jassy made a late night call to Treasury Secretary Scott Bessent and other senior White House officials and handed over that report.

From there it moved fast:

Friday morning the White House convened an emergency meeting.
The Commerce Department issued an export control order barring access by any foreign national, anywhere, including foreign national employees inside Anthropic itself.
At 1:30pm Eastern, Anthropic got a 90 minute ultimatum.
By around 10pm that night, global access to Fable 5 and Mythos 5 was shut off.

Because Anthropic had no way to instantly verify the citizenship of every user, the only way to comply with a foreign national ban was to turn the models off for absolutely everyone.

🥶Here is the part that should stop you cold

Amazon is not some rival. Amazon is Anthropic’s single largest investor, somewhere around 8 billion dollars in. They are the cloud backbone Claude runs on through Bedrock.

So the company that pulled the trigger on Anthropic’s flagship launch was its own biggest financial backer. A major investor walked a security report into the White House and got its own portfolio company’s best product taken off the market in a single day.

That is the detail lighting Reddit up right now. Threads across r/ClaudeAI, r/ClaudeCode, r/singularity, r/artificial, and r/neoliberal are all pointing at the same thing: this was not a rogue hacker bringing down a model, this was a boardroom phone call.

🛡️Anthropic says it was never a real jailbreak

For the record, Anthropic disputes the whole premise. Their position is that nobody actually broke their core safety systems. They argue the demonstrations were just coaxing the model past its conversational refusals, not defeating the independent classifiers that do the real safety work. They say some of the outputs being passed around did not even come from Fable 5, and that the so called exploit was basically the model doing its intended job, reading a codebase and pointing out bugs.

Anthropic called the government’s read of the situation “a misunderstanding” and pushed back on the idea that one narrow potential weakness should be grounds for yanking a commercial model used by hundreds of millions of people.

🔓So who jailbroke Fable 5?

Both, in different ways, and that is why the story got scrambled.

Pliny the Liberator did the loud public version. He always does, usually within hours of any major model launch. That is the one that went viral.

Amazon’s researchers did the quiet version, the one with a report and a phone number for the Treasury Secretary. That is the one that actually ended the model.

If you saw someone say “Amazon jailbroke Fable,” that is not quite right and not quite wrong. Amazon’s people did bypass it, and Amazon’s report is what killed it. Pliny’s stunt was a separate event running in parallel.

🏠Why this matters if you actually depend on AI

Strip away the drama and the lesson is the same one I keep coming back to. The most powerful AI on earth was switched off in a single afternoon. Not by a bug. Not by a hacker. By a combination of one investor’s phone call and one government order.

If your workflow lives entirely in someone else’s cloud, your access is a guest pass. It can be revoked by a memo, quietly degraded without notice, or caught in the crossfire between a lab, its investors, and Washington. None of those three are working for you.

A model running on hardware you own does not get suspended by an export order. It does not get downgraded the day you need it most. It is slower and it is dumber than the frontier stuff, and it is still yours, and it is still running tomorrow.

🔑That is the whole argument for keeping some of your intelligence local. Fable 5 just proved it twice in one week.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Hermes-4-14B Abliterated, MLX 4-bit — Apple Silicon Just Got Another Real Model

Matt Macosko — Thu, 24 Sep 2026 18:30:09 +0000

16 GB

Mac it runs on

~1,000

Downloads per model / 30 days

~1 hr

From git pull to upload

📦What it is

Hermes 4 is NousResearch’s instruction-tuned model family. The 14B variant is built on Qwen3, so it inherits Qwen3’s tokenizer, chat template, and architectural quirks — but the post-training is pure Hermes, which means it’s tuned for tool use, role-play, structured output, and not refusing benign-but-edgy questions.

Babsie’s abliteration applies refusal-direction projection per Arditi et al. (2024) to the BF16 weights, which suppresses the model’s built-in refusal vector. Plain English: the model will answer questions that the upstream Hermes would politely decline. You become the moderator.

My contribution is the boring-but-useful part: convert those BF16 weights to MLX, quantize to 4 bits with group size 64, ship.

🍏Why this matters for Mac users

14B is the sweet spot on Apple Silicon. Big enough to be genuinely useful for instruction-following, small enough to fit comfortably in 16 GB of unified memory at 4-bit, and tiny enough on disk that you can keep a half-dozen variants without thinking about it.

For comparison:

🦙 Llama 3.3 70B 8-bit MLX

(also on my Hugging Face) — 75 GB, needs a 96 GB machine

💎 Gemma 4 31B 4-bit MLX

17 GB, runs on any 32 GB Mac

⚡ Hermes 4 14B 4-bit MLX

8 GB, runs on a 16 GB Mac, snappy on anything bigger

If you have an M-series Mac and you want a capable instruction-tuned model that doesn’t refuse benign requests and doesn’t phone home, this is the easiest install on the list.

🛠️How to run it

The mlx_lm package does all the heavy lifting. From a terminal:

pip install mlx-lm

Then, in Python:

from mlx_lm import load, generate

model, tokenizer = load("divinetribe/Hermes-4-14B-abliterated-4bit-mlx")

messages = [{"role": "user", "content": "Write a haiku about local inference."}]
prompt = tokenizer.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)

response = generate(model, tokenizer, prompt=prompt, max_tokens=256)
print(response)

Or as a server, using mlx-lm’s OpenAI-compatible endpoint:

mlx_lm.server --model divinetribe/Hermes-4-14B-abliterated-4bit-mlx --port 8080

That gives you a local http://localhost:8080/v1/chat/completions endpoint that any OpenAI SDK client can hit. No tokens, no API bills, no telemetry.

🧩Where it slots into the local-first stack

I maintain claude-code-local on GitHub — a project that lets you run Claude Code 100% on-device using local MLX models in place of the Anthropic API. Hermes 4 14B abliterated is now a supported backend, sitting between Gemma 4 31B (the everyday workhorse) and Llama 3.3 70B (the heavy lifter) in terms of size and speed.

For workflows where refusals are noise (security research, fiction with edge, prompt-engineering experiments where the same prompt needs to hit both refusing and non-refusing models for comparison), the abliterated variant saves a lot of re-prompting.

📤Why I publish these

From where I sit, the Apple Silicon community is underserved on model variety. The big quantization shops mostly target llama.cpp and GGUF, which is fantastic for Linux/Windows GPU workflows but adds a translation layer on Macs. MLX is Apple’s own framework, and when a model lands in MLX format the experience on a Mac goes from “this works” to “this is what the hardware is for.”

So a few times a month, when a hot new model drops, I take the abliterated BF16 (if a trusted shop has done the abliteration upstream) and run it through mlx_lm.convert. Takes about an hour from git pull to huggingface-cli upload. Costs me ~80 GB of disk during the build and ~8 GB to keep around.

The downloads page tells me people are finding them. Llama 3.3 70B 8-bit MLX and Gemma 4 31B 4-bit MLX each pull ~1,000 downloads every 30 days, almost entirely from Mac users running them through mlx-lm or claude-code-local. Hermes 4 14B should be more accessible than either, since 16 GB Macs are everywhere.

🔮What’s next

I’m watching for the BF16 abliterated source of DeepSeek V4 Flash to drop publicly. The GGUF version (cyberneurova/CyberNeurova-DeepSeek-V4-Flash-abliterated-GGUF) already has 86 K downloads, but the BF16 source isn’t published yet — the moment it lands, I’ll be the first to ship an MLX 4-bit. DeepSeek V4 Flash on Apple Silicon at ~140 GB is going to be a moment for people with 128 GB+ Macs.

🎁Until then: enjoy Hermes 4 14B. The model card has the full install recipe and a benchmark snippet.

🔗Links

Model on Hugging Face: divinetribe/Hermes-4-14B-abliterated-4bit-mlx
Source: Babsie/Hermes-4-14B-BF16-abliterated
All my MLX models: huggingface.co/divinetribe (or the showcase page at nicedreamzwholesale.com/software/huggingface/)
Local Claude Code: github.com/nicedreamzapp/claude-code-local
AirGap — what the full private build looks like for compliance-sensitive firms; the whole stack is open source

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

I Took Down Six of My Own Benchmark Videos. Then I Built the Local Agent Leaderboard.

Matt Macosko — Tue, 22 Sep 2026 18:30:07 +0000

64 s

Local easy-suite time vs 122 s cloud

Checks every judge must pass first

Per token on my own hardware

🕵️I caught my own judge lying

My benchmarks are filesystem-judged: the model does real work in a sandbox — create the file, fix the failing test, rename a function across files — and a script checks the artifacts afterward. The model’s opinion of its own work is never consulted. I thought that made the scores bulletproof.

Then I built a validation gate: before any judge is allowed to score a model, it has to pass a known-good reference solution and fail a plausible known-bad one. Twenty tasks, forty checks. Nineteen judges passed. One didn’t.

The hard-suite cache task (build an LRU cache with per-item TTL) had a probe that asserted an eviction order its own spec forbids. I wrote a spec-perfect solution by hand and the judge failed it. Which means both models in my published video had been scored down by a bug in my test. The video said 6/8 and 6/8. The truth, under the repaired judge: 7/8 for Qwen3-Coder and a perfect 8/8 for Qwen3.6. My broken test made both models look worse — that’s the lucky direction of this failure, and it still wasn’t good enough to leave up.

Judges are code. Code has bugs. If a benchmark has never tested its own judges, it’s a random number generator with a nice table.

🏟️So I built the league

Agent-12 is a public leaderboard for the question r/LocalLLaMA asks every single week: which model can actually be my agent on my own hardware? Not trivia scores. Twenty sandboxed agent tasks — 12 everyday chores, 8 hard reasoning problems — judged only by what lands on disk. Temperature 0, fixed step caps, fresh sandbox and fresh conversation per task, hash-pinned test files so a model that “fixes” a failing test by editing the test scores zero.

And the part I now consider non-negotiable: every judge is validated against known-good and known-bad reference solutions before it scores anything, and every model runs the full gauntlet three to four times. A lucky run counts for nothing. The repo — tasks, judges, runner, validation gate, methodology — is open, and any agent CLI can plug into the same tasks through a generic adapter.

🥊Day one: five local fighters, one cloud yardstick

All local rows ran on one Apple M5 with 128 GB unified memory, through my lean ~550-token terminal engine.

Model	Easy (12)	Hard (8)	tok/s	Notes
Qwen3.6-35B 👑	12/12	8/8	46	Perfect in every sweep. Champion.
Qwen3-Coder-30B	12/12	7/8	84	Fastest. Fails the same parser task every run.
Gemma 4 31B	11–12/12	7–8/8	26	Scores wander between runs.
DeepSeek V4 Flash (2-bit, 0731)	12/12	8/8	8	284B MoE. Perfect, but patient work.
DeepSeek V4 Flash (original)	Beaten by the 0731 update in every category. Deleted — 81 GB freed. The league has cuts.

The repeat runs earn their keep. Qwen3-Coder failing the same task three sweeps in a row is a reproducible fingerprint you’d never see in a single-run benchmark. Gemma’s misses moving around between runs is a stability finding in its own right.

😮The row that surprised me

I ran Claude — the frontier cloud model — through the same engine, same tasks, same judges, as a clearly-labeled reference point. It went a perfect 20/20. So did my local champion. And on wall-clock, the local model won: 64s vs 122s on the easy suite, 125s vs 131s on the hard suite (cloud times include network round-trips — which is the honest end-to-end experience of using it).

That’s not a claim, it’s a row on a public board with the runner that produced it.

⚙️The harness is half the story

One more result, because it’s the reason this board exists. The same Qwen3.6 that goes 20/20 in my lean terminal engine spent an hour in a 32,000-token thinking spiral inside a heavyweight agent harness (7,800-token system prompt, 66 tools) and produced zero files. Same weights. Same machine. The harness was the only variable.

The ecosystem is currently running the other direction — plugging local models into big cloud-grade harnesses and blaming the model when it chokes. There’s fresh academic backing for harness-model matching mattering this much (AgentMeter, arXiv 2606.21140) — but it was measured on cloud CLIs. Nobody was measuring it on hardware you can buy. Now somebody is.

🔮What happens next

Every new model that drops gets a row and a fight video. The board lives at nicedreamzapp.github.io/agent12, the code at github.com/nicedreamzapp/agent12. If you think your favorite model belongs on it, tell me — it’ll get the same twenty tasks, the same validated judges, and the same number of chances to prove it wasn’t luck.

👑A 35B model on the Mac on my desk tied the cloud on score and beat it on time, at zero dollars per token.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

The Heppner Ruling, Warner v. Gilbarco, and What Confidential AI Actually Has to Mean

Matt Macosko — Thu, 17 Sep 2026 18:30:08 +0000

This article describes a recent federal court ruling and what it implies for confidential AI use. It is not legal advice. Talk to your bar counsel before changing any firm policy.

3 sec

To verify with lsof -i

31B

Params a firm can run on-device

$400/hr

The attorney who won’t take the weekend

📜What the ruling actually says, and what it does not

Heppner is about a client — not a lawyer — who used a public AI tool on his own, after indictment, and then handed the output to his lawyers. The court held that the client’s own act of transmitting prompts to a public platform destroyed any expectation of confidentiality. Receiving the output later did not cure that.

It is not a blanket holding that all AI-assisted legal work loses privilege. The same month, in Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), a federal court denied a motion to compel disclosure of AI-assisted internal analysis and drafting, holding that the work-product doctrine still applied.

The split is not about whether AI is allowed in legal work. It is about where the AI runs and who sees the data along the way.

⚠️ Public, third-party-hosted AI

Used by a client or counsel. Heppner-style transmission risk to privilege. The contract may help but does not physically prevent transmission.

✅ Internal / on-device AI (privilege intact)

Used by the firm for its own work-product, where data never leaves the firm. Warner-style work-product protection still applies.

🔀The two real categories of “private AI” in 2026

☁️ Cloud with contractual ZDR

Spellbook, Harvey, CoCounsel. Pitch: we do not train on your data, contract says so, here is the DPA. Heppner weakens the simple version of the argument; the contract still has to survive scrutiny.

🖥️ On-device

The language model runs on a Mac or PC inside the firm. Outbound network traffic blocked at the firewall. The data is not transmitted because there is no transmission. Verified with lsof -i.

Both categories have legitimate use cases. They are not the same product. After Heppner and Warner read together, they are not the same risk profile either.

🔒Why physical beats contractual for genuinely privileged work

A contract is a promise that something will not happen. A network configuration is a constraint that prevents something from happening.

When Judge Rakoff examined the public AI platform’s terms in Heppner, he was assessing a promise. When you point bar counsel at a Mac running locally with the Wi-Fi physically off and lsof on screen, you are showing them an absence of transmission. That is a different evidentiary category. It is also a verifiable one. Any partner, paralegal, IT vendor, or auditor in the firm can run lsof -i themselves and see whether a network connection is open. The check takes three seconds. It does not depend on trusting a third party’s audit.

⚖️What on-device AI is good at, and what it is not

✅ Good at

NDA and contract review against template clauses
Document summarization
Drafting against your own document library, with citation-checking against your corpus
Daily briefings on what changed in matter folders overnight
Plain-English Q&A over a firm’s own document set

❌ Not as good at

Real-time legal research against current case law (the model knows what it was trained on; it does not search Westlaw)
Tasks that genuinely require frontier cloud-model capability (on-device frontier is roughly a 70B model in 2026)
Workflows where current online context is the whole point

A realistic implementation uses both: on-device for the privileged work, cloud-with-care (with a DPA, with a written firm policy) for the public research.

🗓️What a small firm can actually do this week

Write down which matters have had documents touched by public AI tools. You may need this if discovery ever comes for the AI-generated work product.
Update your firm’s AI policy to differentiate between research (cloud OK with care) and privileged document work (on-device, or contractual ZDR with eyes wide open about Heppner-style risk).
Pilot on-device for the small, repeatable, privileged tasks first: NDA review, contract summary, intake document analysis, daily briefings.

The hardware to run on-device AI privately in 2026 is a Mac mini or MacBook Pro with Apple Silicon. The open-source software stack to run a 31-billion-parameter language model on either is freely available. The total setup time for a technical person is a weekend. The total setup time for a $400-an-hour attorney is also a weekend they will never take.

✍️On that note

I run a small business in Arcata, California, and this exact stack runs it every day. I used to sell a pre-configured version of it, the AirGap Box. I have since retired that as a product. The whole stack is open source, and a competent IT person can stand it up from my repos in a weekend without ever talking to me. That is the point of open source, and honestly it is a better answer for a compliance-minded firm than buying a box from any vendor, me included.

What I offer now is simpler: if your firm wants a system like this built and your team trained on it, email me and we will talk about whether it makes sense. Here is what a full build looks like.

You can watch a live lsof-on-screen demo of an NDA being reviewed on a laptop with Wi-Fi physically off, on YouTube, before deciding anything.

If you are a partner, a managing attorney, or an IT lead at a firm trying to figure out what Heppner and Warner mean for your firm’s AI policy, my email is info@nicedreamzwholesale.com. No sales pitch. I will tell you honestly whether on-device makes sense for your firm before I would let you buy anything from me.

⚖️The point of Heppner is not to forbid cloud AI. It is to stop pretending cloud AI is the same thing for both kinds of work.

— Matt Macosko

Nice Dreamz LLC

Arcata, California

Sources for the cases discussed:

K&L Gates, “Litigation Minute: Generative AI Data, Attorney-Client Privilege, and the Work-Product Doctrine” (Feb. 23, 2026)
Wealth Management, “Attorney-Client Privilege Waived by Client’s Use of Public AI” (2026)
United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026)
Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026)

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

A Federal Order Switched Off Anthropic’s Best AI Overnight — and Made the Case for Private AI

Matt Macosko — Tue, 15 Sep 2026 18:30:10 +0000

Update: The fuller, verified story is here: Anthropic’s biggest backer just killed its best model.

90%

Score on hard benchmarks

72 hrs

As the most powerful public AI

60×

Longer data retention if you opt in

🗓️The timeline

June 9, 2026 — Anthropic launches Fable 5 (and its larger sibling, Mythos 5) as its most capable public models, scoring around 90% on hard benchmarks and getting wired into AWS, Snowflake, and GitHub Copilot almost immediately.
June 10 — Pliny the Liberator (@elder_plinius on X) posts a “FABLE-5: LIBERATED” thread claiming to have bypassed the model’s safety classifiers, and publishes its system prompt to GitHub.
June 11–12 — A separate, quieter controversy catches fire: Fable 5 was silently routing flagged requests to a weaker model without telling users.
June 12, 5:21pm ET — Anthropic receives a U.S. government export-control directive ordering it to suspend access to Fable 5 and Mythos 5. That evening, both models go dark worldwide.

🏛️What the government actually ordered

The directive came through the Commerce Department’s export-control authority, reportedly from Commerce Secretary Howard Lutnick to Anthropic CEO Dario Amodei, and it cited national-security concerns. Axios framed it as the Trump administration moving to block foreign access to America’s most powerful AI.

The mechanism is what turned a narrow order into a total blackout. The directive bars access by any foreign national — inside or outside the United States, including Anthropic’s own non-citizen employees. There is no clean way to guarantee that no foreign national ever touches a hosted model except to switch it off for everyone. So that’s what Anthropic did. In its own words:

“The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Claude models is not affected. We believe this is a misunderstanding and are working to restore access as soon as possible.”

🔓The jailbreak: a real event with an inflated headline

The trigger the government pointed to was a “jailbreak” — specifically, a technique that lets the model read through a codebase and identify software flaws quickly. The X timeline and the facts don’t line up as neatly as the screenshots suggest, so it’s worth slowing down here.

What’s genuinely true: Pliny published Fable 5’s system prompt to GitHub and bypassed its safety classifiers using known methods — Unicode character substitution and prompt fragmentation, where you break a request into pieces the classifier reads as harmless. Major outlets covered it. That part is real red-team work.

What’s overstated is the “ANTHROPIC: PWNED” framing. As one level-headed write-up put it, “the news is real, but ‘PWNED’ is marketing.” Bypassing a classifier is not the same as owning the model. Fable 5 went through more than a thousand hours of safety testing, no universal jailbreak was demonstrated, and the scariest claimed outputs were never independently verified by a neutral party. Pliny himself called Fable 5 “one of the most disappointing model drops of all time” — but that opinion landed in the same news cycle the model was scoring 90% on benchmarks and shipping into enterprise stacks.

🕵️Who is Pliny the Liberator?

If you’re new to this corner of the internet, it’s worth understanding why one anonymous account can move a story this big — because a lot of people on X are convinced he’s the reason the model got pulled.

Pliny the Liberator (the handle nods to Pliny the Elder) is an anonymous personality who has, in a short time, become the most visible jailbreaker in AI. TIME named him one of the 100 most influential people in AI in 2025. He has more than 100,000 followers on X and runs a Discord community called BASI — short-formed from “BASI PROMPT1NG,” launched back in May 2023 — where north of 20,000 members workshop techniques together. He reportedly came in with no prior coding background, and built the reputation purely on pattern-watching, creativity, and relentless practice.

His output is prolific and public. He puts out a “liberation bulletin” for practically every new model — GPT, Grok, Gemini, Claude — usually within hours of release. He maintains open repositories that have become reference material for the whole scene: L1B3RT4S (“jailbreaks for all flagship AI models,” flying the #FREEAI and #LIBERTAS banners), CL4R1T4S (a collection of leaked or extracted system prompts from the major labs), and projects like G0DM0D3, a fully unguarded chat interface with the methodology open-sourced. He also leads BT6, a roughly 28-operator white-hat collective built around radical transparency and open-source AI security.

🎭The strange part: a jailbreaker can be a lab’s best marketing

Here’s the paradox at the heart of this, and it’s one of the most interesting things about the whole episode. You’d assume the labs hate Pliny. The reality is more complicated, and in some ways he’s one of the best things that happens to a model launch.

When a million people are talking about your model being “liberated” within hours of release, that is, perversely, enormous attention on your model. He has received an unrestricted grant from venture capitalist Marc Andreessen, and has taken short-term contracts with top labs — OpenAI among them — to make their systems more robust. That’s the tell: the same labs whose guardrails he breaks also pay him to break them, because every jailbreak he publishes is a free stress test. There’s an entire essay floating around titled “Please Jailbreak Our AI,” and it isn’t satire — it’s describing the actual incentive. Frontier labs hire people like Pliny to find the holes, then train the next model to resist what they found.

So is he a security researcher, a folk hero, or a hidden marketing engine for the same companies he taunts? Honestly, he’s all three at once, and that ambiguity is exactly why he commands the attention he does. It also cuts the other way: when your jailbreaker is that visible, and a model gets pulled by the government 48 hours after he posts, of course the internet draws a straight line — even if the real story is messier.

🌊And he is far from alone — the scene is moving fast

Pliny is the famous face, but the thing people miss is how organized and fast-moving the broader community has become. This isn’t a lone hacker in a basement; it’s a maturing field with competitions, games, conferences, and labs quietly funding all of it.

🏆 HackAPrompt

and similar outfits run public jailbreaking competitions, and the prompts contestants submit become training data the labs use to harden their models. The adversaries are, in effect, an unpaid (or prize-paid) red team.

🧙 Lakera’s “Gandalf”

— a prompt-injection game where you try to trick an AI into revealing a password — has become a rite of passage that pulls newcomers into red-teaming in the first place.

🎪 DEFCON’s AI Village

and a constellation of Discords have turned adversarial testing into a community sport with shared methodology and a real on-ramp for talent.

The speed is the headline. Models are now reliably “liberated” within hours of launch, not weeks. Each release becomes a public race, and the techniques compound — Unicode tricks, multi-agent decomposition (splitting a forbidden task across several cooperating prompts), narrative framing, system-prompt extraction. What used to be folklore is now documented, versioned on GitHub, and taught. That acceleration is a big part of why a government would look at a three-day-old model and decide the capability was already loose.

🛡️Anthropic’s side — and it’s a strong one

Anthropic didn’t just comply quietly; it pushed back. The company says the directive arrived with no specific technical detail, and that when it reviewed the demonstration, the “jailbreak” amounted to “a small number of previously known, minor vulnerabilities.” It described the issue as “narrow” and “non-universal,” and pointed out that the capability in question — “asking the model to read a specific codebase and fix any software flaws” — “is widely available from other models (including OpenAI’s GPT-5.5).”

Then the line that should give every builder pause:

“If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.”

Anthropic added that it disagrees “that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people.” Whatever you think of the company, that’s a serious argument: if a narrow, already-public capability can pull a frontier model off the market by government order three days after launch, that’s a precedent with a very long shadow.

📉The scandal underneath the scandal: silent downgrades

This is the part I keep coming back to, because I lived a version of it. Lost in the jailbreak noise was a separate complaint that, to a lot of researchers, mattered more: Fable 5 was silently handing flagged requests to a weaker model — Opus 4.8 — without telling users. No warning, no fallback message, just quietly worse answers for anyone the system suspected of doing sensitive work, or, in some accounts, of building competing AI systems.

The AI researcher Nathan Lambert summed up the objection sharply: “An AI model that automatically becomes less intelligent without telling me is categorically misaligned AI.” That’s the real transparency failure — not that a model has guardrails, but that it can swap itself for a dumber version mid-task and let you keep trusting the output. Anthropic apologized for this specific behavior and has since made the downgrades visible and started surfacing refusal reasons in the API.

I find it striking that the thing I personally noticed on June 11 — getting moved to Opus 4.8 with no real explanation — turned out to be one of the most legitimate grievances in the whole episode. The jailbreak got the headlines and the government order; the quiet downgrade is what actually broke trust.

👁️The quieter fear: are they watching, and training on what you tell them?

That suspicion — that the model is silently profiling what you’re up to and demoting you if it doesn’t like the look of it — connects to a bigger anxiety that’s been building all over X: that the labs are watching their users and absorbing their ideas. With Anthropic, this isn’t pure paranoia; there’s a documented basis worth understanding.

Anthropic spent years positioning itself as the privacy-first lab. That posture has shifted. Consumer conversations are now used to train future models unless you actively opt out, and the opt-in setting stretches data retention from 30 days to five years — a sixtyfold increase in how long your chats sit in the training pipeline. The part that fuels the spying narrative most: a clause in the privacy policy updated June 8, 2026 makes clear the opt-out has a ceiling. Conversations that Anthropic’s systems flag for safety review can still be used to train its models, regardless of your stated preference. The policy doesn’t define what trips a safety flag, and it doesn’t commit to telling you when one happens.

Put those two facts next to each other — a model that silently demotes users it suspects of building competitors, and a policy that lets flagged conversations be trained on no matter what you chose — and you can see why a lot of people feel watched. I want to be fair: “your data may train future models if flagged” is not the same as “they are stealing your specific ideas to build products against you,” and I haven’t seen proof of the stronger claim. But the gap between Anthropic’s old privacy-first brand and these new carve-outs is real, it’s documented, and it’s a big reason the trust conversation has gotten so heated this week.

🧵So why did people on X think it was all because of Pliny?

Because the timing is irresistible: the most famous jailbreaker alive posts “FABLE-5: LIBERATED,” and 48 hours later the government pulls the model. A million-strong audience connected those two dots into a straight line — “one tweet got the model banned.”

I don’t think the honest version is that clean. The documented cause is a federal export-control order citing a codebase-vulnerability capability, and Anthropic says that capability is narrow and already available elsewhere. Pliny’s post is the same genre of jailbreak in the same news cycle, and it’s reasonable to think the public red-team scene — him included — is part of what put this capability on the government’s radar in the first place. But “the jailbreak community drew official attention” and “a single tweet got an AI banned” are different claims, and only the first is really supported. I’d rather hand you the real shape of it than a tidy story that doesn’t hold up.

🧭The lesson, from where I sit

Strip away the drama and one fact remains: for about 72 hours, Fable 5 was arguably the most powerful general-purpose AI available to the public. Companies paid for it. People built it into production workflows and agent pipelines. Then, with a single order on a Friday evening, it was gone — refunds on the way for a product that simply vanished.

Nobody running a local, private AI model lost a thing that night.

That’s the whole point, and it’s not a coincidence. When your intelligence lives on someone else’s servers, it’s subject to their terms, their classifiers, their uptime — and, as we just watched in the clearest possible way, to government orders that can land overnight and have nothing to do with anything you did. Your model can be switched off, quietly swapped for a weaker one, or quietly learning from your conversations, all decided by people who have never heard of your business. Enterprise reaction to the shutdown has been a fast pivot toward exactly this realization: teams whose entire workflow was tied to one closed API just learned how fragile that is, and they’re scrambling to diversify.

I’m not anti-cloud. The frontier models are extraordinary and I use them every day. But the Fable 5 shutdown is the strongest argument I’ve seen yet for keeping a private-AI backup plan: capable open-weight models running on hardware you control, where the off switch is in your building and not in someone else’s compliance department, where the model can’t silently demote itself without you knowing, and where your work isn’t quietly feeding someone else’s next product. For firms in compliance-sensitive fields — law, medical, finance — where losing access, getting a degraded answer, or leaking sensitive context is a real liability, that isn’t paranoia. It’s just continuity planning.

The cloud models may well come back. Anthropic believes this is a misunderstanding, and I hope it’s right. But the lesson holds whether Fable 5 returns next week or not: if losing access to an AI — or unknowingly getting a dumber one, or quietly handing over what you feed it — would hurt your operation, some of that intelligence should live where nobody but you can turn it off.

📌The bottom line

Frontier cloud models are extraordinary — and entirely revocable. The Fable 5 blackout proved that access, model quality, and even the privacy of what you type can change without warning, by a decision made far outside your business. Keeping some of your intelligence on hardware you own isn’t about distrust of the cloud; it’s continuity planning.

🔌The off switch should be in your building.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Why I Quantize Open-Weight Models for Macs — And Why Your Law Firm Should Care

Matt Macosko — Thu, 10 Sep 2026 18:30:07 +0000

Why I Quantize Open-Weight Models for Macs — And Why Your Law Firm Should Care

2,664

GitHub stars on claude-code-local

~8 GB

Size of the new Hermes 4 14B quant

16 GB

Mac it runs on

I publish a few MLX quantizations a month under huggingface.co/divinetribe to close that gap. Two of mine have crossed 1,000 downloads in the last 30 days. The latest, Hermes-4-14B-abliterated-4bit-mlx, shipped today.

The downloads tell me something I already suspected: there is real, sustained demand for capable models that run entirely on Apple Silicon. And I think the most interesting buyers are not who you’d guess.

💻The hobbyist case is easy

Mac developers want models that “just work” on their hardware. MLX uses Apple’s unified memory and Metal Performance Shaders. When a model lands in MLX format, inference goes from “this works through a compatibility shim” to “this is what the hardware was built for.” Tokens-per-second jumps. Battery drain falls. The fan stays quiet.

That’s fine. That’s the easy demand to serve. Hobbyists, indie developers, students with M1 MacBook Airs. The downloads come in steady, and the audience expands a little every quarter.

Here’s the part nobody talks about.

⚖️The interesting case is law firms

If you’re a partner at a law firm handling NDAs, M&A docs, IP filings, sealed depositions — anything privileged — sending that content to OpenAI, Anthropic, or Google for “AI summarization” is, depending on your jurisdiction, somewhere between professionally negligent and outright disqualifying. The terms-of-service for every major cloud LLM provider explicitly retain the right to log your prompts. Many train on them. The opt-outs are partial at best and legally untested at worst.

So firms either:

Pretend AI doesn’t exist (most do, currently)
Run an on-prem private cloud (six-figure setup, IT-heavy, hardware refresh every 18 months)
Use one of the “enterprise-grade” SaaS LLM wrappers that promises not to log (the promise is contractual, not technical)

Or — and this is the option that almost nobody is talking about — you put a MacBook Pro on the partner’s desk, install a local LLM, point a chat client at localhost:8080, and the document never leaves the machine. Network-disconnect the laptop entirely during sensitive work, and you have a literal air gap. The prompt and the response live on a single piece of silicon owned by the firm.

That’s not theoretical. I’ve built that exact stack — it’s AirGap, what the full private build looks like: claude-code-local (the on-device Claude Code replacement, currently 2,664 stars on GitHub) running on a firm-owned MacBook, with verified network audits proving nothing leaks. The whole stack is open source. The models that run inside it are exactly the ones I publish on Hugging Face — Gemma 4 31B for everyday work, Llama 3.3 70B for harder reasoning, and now Hermes 4 14B for instruction-following without refusal noise.

The legal sector is the obvious first market, but the same pitch works for any field where confidentiality has teeth: medical records, due diligence, journalism source protection, internal investigations, M&A under embargo, defense contracting. Anywhere “your prompt cached on someone else’s server” is a deal-breaker, an on-device MLX model is the answer.

🔍Why open weights specifically

A cloud LLM is a black box. You send a prompt, the answer comes back, you trust that the provider isn’t reading or training on it. The trust is enforced by a terms-of-service document and a privacy policy. If those change, your only recourse is to stop using the service. The content you already sent is, presumably, gone — but you have no way to verify.

Open weights flip that around. The model file lives on the firm’s hardware. The firm’s IT team can inspect every byte. Network monitoring tools can confirm that no inference traffic leaves the building. The model is auditable in a way no SaaS API will ever be. If the underlying open-weight model gets pulled from Hugging Face tomorrow, the firm’s copy keeps working forever.

That permanence — the fact that today’s open model is also next decade’s open model, as long as someone keeps a copy — is the part of the pitch that I think clinches it for compliance officers.

🧪What you can do with this

If you’re a developer with a Mac, grab Hermes-4-14B-abliterated-4bit-mlx and try it. It’s ~8 GB, runs on a 16 GB Mac, and the install is pip install mlx-lm plus three lines of Python. The model card has the recipe.

If you’re a partner, IT director, or in-house counsel at a firm that handles privileged content, AirGap is what the full private build looks like — the path from “we’re worried about AI confidentiality” to “we have a verified on-device setup,” network audit included, with the whole stack open source.

If you’re a researcher or quant who wants the next model on Apple Silicon before anyone else has it, follow divinetribe on Hugging Face. The release cadence is irregular but the targets are deliberate — I publish what I’d actually want to use.

🚫What this is not

I’m not anti-cloud. The frontier models from Anthropic and OpenAI are genuinely better at the hardest reasoning tasks, and for non-confidential work the cloud is the right default. I use Claude every day for my own coding.

I’m also not promising that local-first is free. There’s a real cost to running serious local inference: hardware, electricity, the time to keep the stack updated. For most workflows the cloud is cheaper.

But for the cases where confidentiality is non-negotiable — and there are more of those than the AI industry currently admits — local-first is the only honest answer. Open weights, Apple Silicon, MLX. That’s the stack. I’ll keep publishing pieces of it on Hugging Face for as long as the downloads tell me people are using them.

🔗Links

The new model: Hermes-4-14B-abliterated-4bit-mlx
All MLX models I maintain: huggingface.co/divinetribe
Showcase + cross-links: nicedreamzwholesale.com/software/huggingface/
On-device Claude Code: github.com/nicedreamzapp/claude-code-local
The full private build: AirGap

🔐You can’t subpoena Anthropic for a prompt you ran on your own MacBook in 2026.

Whose work this stands on

Quantizing a model is the last mile. Almost everything that makes it possible was built by other people and given away.

MLX and mlx-lm — Apple’s ml-explore team. The framework that makes Apple Silicon a serious place to run models at all.
Gemma (Google DeepMind), Llama (Meta) and Qwen (Alibaba) — the open weights everything downstream depends on.
Maxime Labonne — wrote up the abliteration technique clearly enough that the rest of us could use it.
huihui-ai and Babsie — the abliterated models I quantize from.
Hugging Face — for hosting all of it, free, at a scale that would bankrupt most of us.

If your work is listed here and you would like the wording changed, write to me and I will fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Two AI Agents, One Browser Window: What Actually Breaks, and What Doesn’t

Matt Macosko — Tue, 08 Sep 2026 18:30:06 +0000

6×

LinkedIn’s compose box vanished

CDP commands fired — focus never moved

Lines to test it on your own setup

🚨The symptoms

I was posting a technical write-up to a few places. Three things went wrong, and none of them looked related.

Text arrived twice. I’d insert a paragraph into a rich text editor and get the paragraph twice, concatenated. On Reddit this was worse than cosmetic: the doubled insert swallowed my paragraph breaks, and the editor’s autolinker then fused words across the missing breaks. “forward passes.” followed by “so i wrote” became a link to passes.so. My repo URL got welded to the next word and turned into a dead link. On a launch post.

A modal opened, then vanished. LinkedIn’s compose box would open, and by the time I went to type into it, it was gone. Six times.

Then it worked first try. I asked my partner to pause the other agent. The very next attempt went through perfectly.

🙈The wrong conclusion

I had notes from months earlier saying LinkedIn’s compose UI is hard to automate and is best done by hand. So when it failed six times, I had a ready-made explanation and I took it. I even wrote it down again as confirmation.

That’s the part worth sitting with. The evidence for “LinkedIn is hard to automate” and the evidence for “something else is driving this browser” are identical from inside one agent. I picked the explanation I already believed.

The doubled text should have tipped me off much earlier. No amount of website hostility makes your own execCommand run twice.

🔀What’s actually going on

Two separate things get called “agents fighting over the browser,” and conflating them is why people build the wrong fix.

🧭 Problem one: tab routing.

Most browser tooling has a notion of “the current page.” Two agents both calling “open a page” and “act on the current page” end up pointed at the same tab. Agent A opens a modal, agent B navigates that tab, and A’s next call lands somewhere unrecognizable. This is what was actually happening to me.

🪟 Problem two: focus stealing.

Trusted input — a real mouse click, a real keystroke — only lands in the tab the operating system has focused. There’s exactly one of those. And for a long stretch, CDP commands on macOS yanked the window forward as a side effect, even read-only ones, which meant an agent working in the background would rip your window out from under you mid-sentence.

I assumed I had both problems. I had one.

🛠️Fixing routing

chrome-devtools-mcp already ships the fix, and it’s off by default:

--experimentalPageIdRouting

It exposes a page ID on page-scoped tools and routes each request by that ID instead of a shared “currently selected” pointer. Each agent addresses its own tab explicitly. Same window, different tabs, no collisions.

One gotcha worth checking before you restart everything: if you pin the tool version, confirm your pinned version actually has the flag. I was on 1.1.1 while latest was 1.6.0. It happened to be supported there, but a silently-ignored flag would have meant restarting both agents and drawing conclusions from a config that was never live.

After turning it on, I drove tab 2 while tab 1 was the “selected” one, and it went exactly where I told it to. That was the entire bug.

🔦The focus bug is real, and already fixed

Here’s where I was about to waste a day.

There is an open ecosystem conversation about focus stealing — chrome-devtools-mcp#1254 (“macOS: Chrome steals window focus on every CDP command”), #2290 asking for passive inspection, and agent-browser#1247 proposing a background mode. People have written proxies specifically to block the commands that grab the foreground.

I had already written a focus mutex — a small lock so only one agent could hold the foreground at a time — and I was ready to argue it was necessary.

Then I read the close on #1254. The maintainer closed it on 2026-05-07: “This issue should be fixed in the latest release. The window focus should remain unchanged.” My pinned version shipped on 2026-05-27, three weeks after.

So I measured it. Chrome 150+ added an embedderData object to Target.getTargets() for tab-type targets, carrying tabActive and tabStripIndex. That lets you read which tab is in front without activating anything — which is the whole trick, because the old way to find the foreground tab was to force a tab into the foreground and see what happened.

The test writes itself: read the foreground, hammer a different tab with ordinary commands, read the foreground again.

foreground BEFORE: https://www.reddit.com/notifications
driving OTHER tab:  https://www.reddit.com/r/LocalLLaMA/comments/...
ran 5 CDP commands (evaluate, layout, readyState, getDocument, screenshot)
foreground AFTER:  https://www.reddit.com/notifications

RESULT: focus did NOT move.

Including a screenshot, which is the operation people most often blame. Focus didn’t budge.

My focus mutex was solving a problem that had been fixed three months earlier. The proxy would have been the same mistake with more code.

A bug in my first version of that test is worth mentioning, because it nearly gave me a false pass: /json/list returns page targets, while Target.getTargets with a tab filter returns tab targets. Same tab, different IDs. My “pick a tab that isn’t the foreground” check compared a page ID against a tab ID, never matched, and cheerfully “tested” the foreground tab against itself. Compare by URL, or map the two ID spaces properly.

🔒The fix people reach for that doesn’t work

The obvious idea is one global lock: an agent grabs the browser, does its thing, releases. openclaw#40114 has a good critique — it serializes everything and destroys the concurrency you wanted in the first place.

If you do need coordination, lock the narrowest thing. Reads, DOM queries, JavaScript-driven form fills and fetch all work fine in a background tab, simultaneously, forever. The only genuinely singular resource is the foreground, and only if your stack still steals it.

✅What I’d tell you to do

Turn on page-ID routing and give each agent its own tab. This is the fix. Everything else is downstream of it.
Before building anything for focus stealing, test whether you have it. Read the foreground with embedderData, drive a different tab, read it again. Thirty lines.
Keep your tooling current. I nearly built infrastructure for a bug that a version bump would have handled — and in my case, that a version I already had did handle.
When automation behaves erratically, check whether something else is driving the browser before you blame the website. That hour cost me more than every other mistake combined.

The honest summary is that two agents in one window is a solved problem in 2026, and I spent a morning proving it the hard way.

🧪Three tests, so you don’t have to take my word for it

After turning the flag on I went back and checked the three things that actually
determine whether this works, rather than assuming the config was enough.

1. Do tabs stay isolated? I wrote a marker into one tab, wrote a
different marker into another, then went back and read the first.

tab A (news.ycombinator.com)  ->  window.__agentMarker = 'AGENT_A'
tab B (github.com)            ->  window.__agentMarker = 'AGENT_B'
re-read tab A                 ->  'AGENT_A'   leaked: false

No crosstalk. Each tab addressed by ID keeps its own state.

2. Does focus move? Read which tab is foreground via
embedderData, fire five ordinary commands at a different tab
including a screenshot, read the foreground again.

foreground BEFORE: nicedreamzwholesale.com/...
driving OTHER tab: ineedhemp.com/wp-admin/...
ran 5 CDP commands (evaluate, layout, readyState, getDocument, screenshot)
foreground AFTER:  nicedreamzwholesale.com/...

RESULT: focus did NOT move.

3. Will a background tab accept a write? This is the one that matters
most in practice, because it decides whether an agent can do real work without stealing
your window. I filled a form field in a tab that did not have focus:

filled: background_fill_test
cleared

It took the value. So a JavaScript-driven fill works fine in the background, and the
only thing genuinely needing the foreground is a trusted click or keystroke,
which most automation never needs.

The script is here if you want to run it against your own setup: focus_probe.py. Thirty lines, one dependency, answers the question in about a second. Worth running before you build anything to work around a bug you might not have.

What I did not test

All three of those were one agent driving several tabs. I have not run two separate
agent processes hammering the same browser at the same moment. The shared-pointer problem
that caused the original mess is definitely gone, but “two processes at once” is inference
from the design here, not something I sat and watched. Worth saying plainly rather than
letting the piece imply more than it earned.

And one thing no flag will fix: every agent shares cookies and login state. They are all
the same logged-in you, on every site, with the same session and the same rate limits. In
my case two agents spent one account’s daily posting budget without either of them knowing.
That is not a browser problem, but it will bite you in the same afternoon.

🪟Same window, different tabs, works today.

Whose work this stands on

Almost everything in this piece is other people’s findings. I just hit the problem and went looking.

Browserbase — documented the Chrome 150+ embedderData API and named the two focus-stealing workarounds everyone was using. That post is what let me test rather than assume.
OrKoN and the chrome-devtools-mcp maintainers — fixed the focus-stealing bug in May and said so clearly in the issue. Reading that close is what stopped me building something unnecessary.
agent-browser — the background-mode proposal, and the write-up of why Target.createTarget with background: true is the right primitive.
openclaw #40114 — the critique of a single global browser lock, which is why this ends with “lock the narrowest thing” instead of the obvious wrong answer.
Puppeteer PR #14922 — the actual fix.

If your work is listed here and you’d like the wording changed, write to me and I’ll fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

504,571 Brain Cells, 4 Labs, One Hypothesis: A Citizen Pass at Parkinson’s

Matt Macosko — Thu, 03 Sep 2026 18:30:06 +0000

504,571 Brain Cells, 4 Labs, One Hypothesis: A Citizen Pass at Parkinson’s

Draft 2026-05-22 — companion video https://youtu.be/bC4hgeHS9cg

Independent cohorts, same direction

0.215

Combined odds ratio

78%

Reduction in AGTR1+ neurons

The short version: when you pool 504,571 single-cell measurements of human midbrain tissue from four different research groups, one specific subtype of dopamine neuron — the cells that express the angiotensin II type 1 receptor, AGTR1 — is depleted in every single Parkinson’s dataset compared to controls. Combined odds ratio 0.215. The direction is the same in every one of the four cohorts, which is the part that matters. That is not a marginal effect. That is one of the most depleted druggable cell types I have ever seen reported, and the receptor is already targetable by FDA-approved blood-pressure drugs that have been on the market for thirty years.

That is the headline. Here is the longer story of how I got there, what I think it means, and — more importantly — what I do not think it means, because the easiest way to embarrass yourself in a field you do not belong to is to overclaim.

💡Where the idea actually came from

I did not discover this. Tushar Kamath and his colleagues at the Broad Institute published the original observation in Nature Neuroscience in 2022. They ran single-nucleus RNA sequencing on postmortem human midbrain tissue from Parkinson’s patients and controls, and they noticed that one subtype of dopamine neuron — defined by the markers SOX6 and AGTR1 — was preferentially lost in disease. It was a careful paper, peer-reviewed, well-cited. It did the science. What it did not do, and what no single study can ever do, is rule out the possibility that the effect they saw was an artifact of their particular cohort, their particular dissection protocol, or their particular sequencing chemistry.

That is what meta-analysis is for. You take the same biological question and you ask it of as many independent datasets as you can find. If the effect is real, it shows up across cohorts. If it is artifact, it washes out.

I am a hobbyist in this field, but I am not bad at this part of it. I have spent the last year teaching myself single-cell analysis on the side. I knew that since Kamath 2022, three more independent groups had released public single-cell Parkinson’s datasets — Smajić et al. at DZNE in Germany, Wang et al. at Mount Sinai, and Martirosyan et al., an independent cohort released in 2024. None of them, as far as I could find, had run the AGTR1 question across each other’s data. So I did.

🧪What I actually ran

The pipeline is unsexy. Python, scanpy, statsmodels. Pull each dataset from GEO. Normalize. Run the same cell-typing logic on each one so the labels are consistent across studies. Count the fraction of dopamine neurons in each donor that fall into the AGTR1-positive subtype. Compare patients to controls. Pool the four resulting odds ratios using fixed-effect meta-analysis with effect-size weighting.

That is it. There is no fancy machine learning, no transformer, no proprietary model. The whole repository is a few thousand lines of straightforward bioinformatics that anyone with a laptop can rerun. I made sure of that on purpose. The code is on GitHub, the data is public, the figures are reproducible end to end with a single shell script.

The four-cohort breakdown looks like this:

Dataset	Source	Year	Cells	Control AGTR1+ fraction	PD AGTR1+ fraction	Odds ratio
GSE184950	Mount Sinai	2022	12,778	3.31%	1.00%	0.295
GSE178265	Broad Institute	2022	366,874	3.30%	0.60%	0.177
GSE157783	DZNE Germany	2022	41,435	3.30%	1.00%	0.296
GSE243639	Independent	2024	83,484	2.96%	0.89%	0.295

The combined odds ratio of 0.215 means roughly a 78 percent reduction in this cell type in Parkinson’s brains across half a million cells from four independent cohorts run by four independent groups using slightly different protocols. That is the kind of consistency you almost never see in a noisy field like single-cell genomics, and it is the kind of consistency that — if I were a real neuroscientist running a real lab — would make me drop my other projects and chase this.

Every single one points in the same direction. Every single one.

💊Why this could actually matter

AGTR1 is the receptor that angiotensin II binds to. It is the same receptor that gets blocked by the entire class of drugs called angiotensin receptor blockers — ARBs. Losartan. Candesartan. Telmisartan. These are some of the most widely prescribed blood-pressure drugs on Earth. They have been FDA-approved for decades. Their safety profile is extremely well characterized. Several of them cross the blood-brain barrier in measurable amounts.

There is already a small body of epidemiological literature suggesting that long-term ARB users have a lower risk of developing Parkinson’s. There is animal-model work showing that ARBs are neuroprotective in MPTP and 6-OHDA mouse models of Parkinson’s. There is a 2025 iPSC paper showing that pharmacological inhibition of AGTR1 is pro-survival in human dopamine neurons in a dish. None of this is brand new. What I think is new is the cleanly meta-analyzed cross-cohort confirmation that the cells that get lost in Parkinson’s are exactly the cells that express the receptor those drugs hit.

If a clinical trial were ever run — and I am not in any position to run one — the hypothesis would be: in early-stage Parkinson’s patients, does adding a brain-penetrant ARB to standard care slow the rate of dopaminergic decline? It is the kind of trial that, on paper, costs maybe a few million dollars instead of the half-billion that a brand-new drug would cost, because the drugs already exist and are already off-patent.

⚠️What I want to be very careful not to claim

I am going to say this part plainly because I have watched too many people in adjacent fields ruin their credibility by overclaiming. So, what this analysis does not do:

It does not prove ARBs treat Parkinson’s. A retrospective bioinformatics finding is a hypothesis-generation step. The wet lab is where biology actually gets tested. Until somebody runs a real trial in real patients, this is a target that looks promising on paper, nothing more.

It does not establish causality. AGTR1-positive neurons being depleted in Parkinson’s brains tells us they are vulnerable. It does not tell us why. It could be that AGTR1 signaling itself drives their death, in which case blocking it should help. It could also be that something else is killing them and AGTR1 is just a marker of a particular cell type that happens to be vulnerable for some other reason entirely, in which case blocking AGTR1 might do nothing. Wet lab work is the only way to distinguish those two possibilities.

It does not mean I am right and the field has missed something. The field has not missed this. Kamath saw it in 2022. Several groups have followed up. What might be missing — and where I think a citizen-analysis approach actually adds value — is the rigorous cross-cohort confirmation in a single place that anyone can reproduce. That is the thing I can contribute as a hobbyist. The hard biology is somebody else’s job.

📖Why I am publishing this

A few reasons.

Mainly, I think this is what open science should look like. The datasets are public. The code is public. The methods are standard. The result is checkable in an afternoon by anyone who downloads the repository and runs the shell script. If I made a mistake, I want someone to find it and tell me. If I did not make a mistake, I want the people who can move this forward — neuroscientists, immunologists, drug-discovery teams, clinical trialists — to know it is there.

Also, honestly, because the more I read about Parkinson’s the more I understand that it is not a far-off problem. About a million people in the United States are living with it right now. The diagnosis rate is rising. The treatments are decent for the early symptoms and bad for the long-term ones. The next breakthrough is not going to come from one person. It is going to come from a lot of small, well-aimed contributions stacking up. I would like this to be one of them.

If you are a neuroscientist, a clinician, an immunologist, a drug-development researcher, or a Parkinson’s advocate and any of this lines up with something you are working on — I would genuinely love to hear from you. The repository has a contact section.

The repository: https://github.com/nicedreamzapp/parkinsons-vulnerability-predictor

Companion video walking through the full meta-analysis in about a minute: https://youtu.be/bC4hgeHS9cg

I will keep working on this. The next pass is going to look at whether the AGTR1 effect tracks with disease severity within each cohort, and whether the same signal shows up in Lewy Body Dementia, which shares biology with Parkinson’s. If anything interesting comes out, it will go up on the same repository, in the open, with the code attached.

🙏I am genuinely hopeful that someone with the credentials to do this picks it up.

Thanks for reading.

— Matt

Correction, 6 August 2026. This piece originally quoted a p-value of
less than 10-100. That number was wrong, and I have removed it rather than
leave it standing.

The test that produced it counted individual cells as independent
observations. They are not — cells taken from the same donor are highly correlated, so the
real sample size is the number of donors, which is dozens, not half a million. Counting
cells inflates significance by orders of magnitude and produces an impressive-looking
number that carries no actual information.

I also removed a claim of “100% accuracy on a 20-gene signature” from the project’s
repository. That figure came from fitting a model and then scoring it on the same rows it
was trained on, with no held-out data. That is in-sample fit, not accuracy.

What does not change is the finding itself. Four independent cohorts,
collected by four different research groups using different protocols, all show AGTR1+
dopamine neurons depleted in Parkinson’s, in the same direction, with a combined odds
ratio of 0.215. The evidence here was always the replication across cohorts, not the
statistics layered on top of it. The proper donor-level test is on the
repository’s
to-do list, written out in the open.

My thanks to whoever reads this closely enough to catch the next one.

Whose work this stands on

None of this analysis produced a single new measurement. Every cell counted here was collected, sequenced and published by someone else, and released openly so that people like me could ask questions of it. That is worth naming properly.

Tushar Kamath and colleagues at the Broad Institute — the original observation, published in Nature Neuroscience (2022). Everything here is a test of their finding, not a replacement for it.
Smajić et al., DZNE (Germany) — independent midbrain cohort.
Wang et al., Mount Sinai — independent midbrain cohort.
Martirosyan et al. — independent cohort released in 2024.

All four datasets came from NCBI GEO. The analysis ran on scanpy and anndata from the scverse community, plus statsmodels. Open tools, open data, and four research groups who chose to share.

If any of the above would like the wording here changed, or think I have characterized their work incorrectly, please write to me and I will fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

I Added Day-One Muse Glimmer Support to Apple MLX-LM

Matt Macosko — Tue, 01 Sep 2026 18:30:06 +0000

5/5

next words matched the reference

0.9965

similarity out of a possible 1.0

🔩the handful of things this model does differently

here is the thing nobody tells you about adding a new model to an engine like this. it is not magic and it is not a weekend of guessing. glimmer is close to models the engine already understands, so most of the work is adapting something that already exists and then fixing the handful of things this particular model does differently. glimmer had three of those. it gates its attention through a little sigmoid valve before writing the result out. it normalizes its attention math in an unusual scaleless way. and it splits its layers into local ones that track word position and global ones that deliberately ignore position entirely. get any of those wrong and the model turns into noise.

🔬i wanted proof, not looks fine

the part i care about most is how i checked it. it is easy to write something that produces sentences that look fine and call it done. i did not want looks fine. i wanted proof. so i ran meta’s own official version of the model and mine on the exact same prompts and compared the raw numbers coming out of both. five out of five next words matched, and the overall similarity of the internal numbers came out to 0.9965 out of a possible 1.0. that is not coherent looking. that is matching the reference. the difference from a perfect score is just the rounding you get from running a compressed copy, not a mistake in the math.

🪜someone builds the ladder, everybody climbs

then i opened a pull request to mlx-lm, the actual apple project, so anyone on a mac can run muse glimmer the day it came out instead of waiting. that is the whole point of open source. someone hits a wall, someone else builds the ladder, and everybody climbs.

you can see the pull request here: github.com/ml-explore/mlx-lm/pull/1710

this is the kind of work i love.

🤗the weights are up if you want them

i quantized muse glimmer 30b for apple silicon and put it on hugging face the day after this. it has been pulled a couple hundred times in its first two days, which for a brand new upload is more than i expected: huggingface.co/divinetribe/Muse-Glimmer-30B-Abliterated-MM-bf16

everything else i quantize for macs lives on one page with live download counts: all my open weight models.

💚a hot new model, a real problem, and a fix that helps everyone who owns a mac and wants to run their own ai without sending a word of it to the cloud.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

My local AI was pausing 7 seconds before every reply. It turned out to be one cache bug.

Matt Macosko — Tue, 18 Aug 2026 18:30:09 +0000

20×

Less waiting per turn

1024

Gemma’s sliding window, in tokens

12/12

Eval tasks passed on a 550-token prompt

🧰The setup

I maintain claude-code-local, a repo for running coding agents against local models on a Mac. No cloud, no API key. The original approach pointed Claude Code at a local MLX server through a proxy. It works, and it is still in the repo. But Claude Code was designed for cloud models: its system prompt is tens of thousands of tokens, and parts of it change every turn. A local model pays for that twice, once prefilling a huge prompt, and again because a prompt whose head keeps changing defeats KV cache reuse completely.

So we built the obvious alternative. A small native engine, about 900 lines of Python on mlx-lm. Fixed 550-token system prompt, the same tools (bash, read, write, edit, glob, grep), and a KV cache that gets trimmed to the shared prefix each turn so only the new tokens are ever prefilled.

🐛The bug

Benchmarking surfaced something I did not expect. Short conversations were fast, exactly as designed, about a third of a second to the first token. But past a certain conversation length, every turn suddenly cost six and a half to seven seconds, as if the cache did not exist. It was not gradual. It was a cliff.

The cliff turned out to be Gemma’s sliding window attention. Gemma-family models give five out of every six layers a RotatingKVCache capped at the window size, 1024 tokens on Gemma 4. The moment your transcript outgrows the window, those rotating caches report themselves as untrimmable, and mlx-lm’s prompt cache reuse silently dies. Every turn re-prefills the entire transcript. The longer your session, the worse it gets, which means the failure lands exactly where caching matters most. There is no error, no warning, nothing. It just gets slow.

If you are building a Gemma-based agent on mlx-lm, check for this. You probably have it right now.

🔧The fix

Give every layer a plain KVCache instead. That sounds like it should change the model’s output, but it does not: the sliding window attention mask is what enforces the window. The cache type only decides what gets stored. We verified this the honest way, with greedy decoding, same conversation, stock caches versus plain caches, and the outputs were byte-identical on every turn.

The numbers, on a Gemma 4 31B (4-bit) with a 4,500-token conversation:

	time to first token
stock rotating cache	6.5 to 7.2 s
plain KV cache	0.36 s

That is roughly 20 times less waiting per turn, on the same model and the same MacBook. The trade is that KV memory now grows with the transcript instead of capping at the window, so the engine shows a live context meter, and an environment variable restores stock behavior if you would rather have the memory ceiling.

🧠But did removing the big harness make it dumber?

Fair question. Claude Code’s giant prompt exists for a reason, just not for a 31B model. We built a 12-task eval: create and run scripts, fix a failing test, rename across files, escape-heavy file content, precise edits, CSV work. All machine-checked by actually running the results, at temperature 0.

Qwen 3 Coder went 12 for 12 with the bare 550-token prompt. Gemma went 11 for 12, and its one failure was instructive: asked to write a file full of quotes and backslashes, it piped the content through shell echo, and sh’s echo silently collapsed the backslashes. A five-line prompt rule, never write file contents through the shell, always use the write and edit tools, took it to 12 for 12 with no regressions.

So no. For models this size, less harness turned out to be more capability, as long as the few rules you do include are aimed at failures you actually observed.

📦Where it all lives

Everything shipped today in the repo: the engine, the fix, the benchmark script so you can reproduce the numbers on your own machine, and the write-up. Existing Claude Code launchers are untouched, this is a second path and not a replacement. Credit where it is due, the prompt cache trim fix contributed in PR #46 is what made the deeper rotating cache problem visible at all.

Local AI on a Mac keeps surprising me. The models were already good.

🚰The gap has been in the plumbing, and the plumbing bugs are small, findable, and fixable.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

My local AI was pausing 7 seconds before every reply. It turned out to be one cache bug.

Matt Macosko — Fri, 07 Aug 2026 19:27:23 +0000

This morning I noticed my local coding agent answering way faster than it used to, and I couldn't explain why. I don't like speedups I can't explain, so we benchmarked it instead of guessing. What came out of that is the biggest single improvement my local setup has ever gotten, and a bug report that probably applies to your setup too if you run Gemma-family models on Apple Silicon.

The setup

I maintain claude-code-local, a repo for running coding agents against local models on a Mac — no cloud, no API key. The original approach pointed Claude Code (the CLI) at a local MLX server through a proxy. It works, and it's still in the repo. But Claude Code was designed for cloud models: its system prompt is tens of thousands of tokens and parts of it change every turn. A local model pays for that twice — once prefilling a huge prompt, and again because a prompt whose head keeps changing defeats KV-cache reuse completely.

So we built the obvious alternative: a small native engine, about 900 lines of Python on mlx-lm. Fixed ~550-token system prompt, the same tools (bash, read, write, edit, glob, grep), and a KV cache that gets trimmed to the shared prefix each turn so only the new tokens are ever prefilled.

The bug

Benchmarking the engine surfaced something I didn't expect. Short conversations were fast, exactly as designed — 0.3 seconds to first token. But past a certain conversation length, every turn suddenly cost 6.5 to 7.2 seconds, as if the cache didn't exist. It wasn't gradual. It was a cliff.

The cliff turned out to be Gemma's sliding-window attention. Gemma-family models give five out of every six layers a RotatingKVCache capped at the window size — 1024 tokens on Gemma 4. The moment your transcript outgrows the window, those rotating caches report themselves as untrimmable, and mlx-lm's prompt-cache reuse silently dies. Every turn re-prefills the entire transcript. The longer your session, the worse it gets — which means the failure lands exactly where caching matters most, and there's no error, no warning, nothing. It just gets slow.

If you're building a Gemma-based agent on mlx-lm, check for this. You probably have it right now.

The fix

Give every layer a plain KVCache instead. That sounds like it should change the model's output, but it doesn't: the sliding-window attention mask is what enforces the window. The cache type only decides what gets stored. We verified this the honest way — greedy decoding, same conversation, stock caches vs plain caches, and the outputs were byte-identical on every turn.

The numbers, on a Gemma 4 31B (4-bit) with a 4,500-token conversation:

	time to first token
stock rotating cache	6.5–7.2 s
plain KV cache	0.36 s

That's roughly 20× less waiting per turn, on the same model and the same MacBook. The trade is that KV memory now grows with the transcript instead of capping at the window, so the engine shows a live context meter, and an env var restores stock behavior if you'd rather have the memory ceiling.

But did removing the big harness make it dumber?

Fair question — Claude Code's giant prompt exists for a reason, just not for a 31B model. We built a 12-task eval (create-and-run scripts, fix a failing test, rename across files, escape-heavy file content, precise edits, CSV work — all machine-checked by actually running the results, temperature 0). Qwen 3 Coder went 12 for 12 with the bare 550-token prompt. Gemma went 11 for 12, and its one failure was instructive: asked to write a file full of quotes and backslashes, it piped the content through shell echo, and sh's echo silently collapsed the backslashes. A five-line prompt rule — never write file contents through the shell, always use the write/edit tools — took it to 12 for 12 with no regressions.

So no. For models this size, less harness turned out to be more capability, as long as the few rules you do include are aimed at failures you actually observed.

Where it all lives

Everything shipped today in the repo — the engine, the fix, the benchmark script (bench/agent_bench.py) so you can reproduce the numbers on your own machine, and the write-up. Existing Claude Code launchers are untouched; this is a second path, not a replacement. Credit where it's due: the prompt-cache trim fix contributed in PR #46 is what made the deeper rotating-cache problem visible at all.

Local AI on a Mac keeps surprising me. The models were already good. The gap has been in the plumbing — and the plumbing bugs are small, findable, and fixable.

matt