DEV Community: Matt Macosko

How to run Claude Code locally on a Mac, free and offline

Matt Macosko — Tue, 03 Nov 2026 21:43:58 +0000

Claude Code can run on a local model on your own Mac. No API key, no cloud model, no usage limit. I built the open source piece that makes it work, called Claude Code Local, and this is the practical guide to setting it up.

Here's the demo if you'd rather watch first: https://www.youtube.com/watch?v=a9vtBSl_j_o

What it is

Claude Code reads an environment variable called ANTHROPIC_BASE_URL, and Claude Code Local is a small Python server that answers there. It runs open AI models on your Mac's chip with Apple's MLX and replies in Anthropic's own Messages API format. Most local setups put a translator in the middle, because local servers usually speak OpenAI's format. This one speaks Claude Code's language directly, so there's nothing in between.

The server also turns each model's own tool call format (Gemma 4, Qwen, Llama JSON) into Claude Code tool calls, repairs garbled tool JSON, and reuses the prompt cache between turns so long sessions don't re-read everything. That's what lets file edits, commands and tools work the same way they do with Claude.

It's MIT licensed and v1.0.0 just shipped.

What you need

A Mac with Apple Silicon (M1 or newer). Python 3.12, which setup installs for you. Claude Code, which the installer adds if it's missing.

Which model for your RAM

You don't have to pick. Setup looks at your Mac's memory and chooses a model that fits:

Your Mac's memory	The model you get
Under 16 GB (8 GB)	Qwen 3.5 2B, 8-bit, reads images, 16K context, server peaks at 4.2 GB
16 GB (MacBook Air, base models)	Qwen 3.5 4B, bf16, reads images, 16K context, server peaks at 10.6 GB
32 to 63 GB (Pro)	Gemma 4 12B
64 to 95 GB (Max)	Gemma 4 31B
96 GB and up (Max, Ultra)	Qwen 3.8 27B, 8-bit

On the small Macs, the speeds we measured on an M4 Pro were 22 tokens a second for the 4B model and 92 for the 2B. Both passed our Claude Code test: read a file, fix a bug with Edit, run a script, describe an image. The full numbers and settings are in docs/SMALL-MACS.md.

On the big end, Qwen 3.8 27B passed our Claude Code test (write a file, run it, report) in 38 seconds. We also score models on our open Agent-12 leaderboard, where it got 12/12 easy and 7/8 hard. Those scores come from Agent-12's own harness, not from inside Claude Code, and Claude Code sends the model a lot more per turn.

A local model is not Claude Opus, and I won't pretend it is. Big models on a 64 GB or 96 GB Mac handle real multi step work. On 8 or 16 GB, keep requests to one clear step at a time.

Install it in one line

curl -fsSL https://raw.githubusercontent.com/nicedreamzapp/claude-code-local/main/install.sh | bash

If you'd rather read the script first:

git clone https://github.com/nicedreamzapp/claude-code-local
cd claude-code-local
bash setup.sh

Setup picks your model, downloads it, installs the server, and puts Claude Local.command on your Desktop. Double click it and you're coding on your own machine.

If you get asked to sign in to a Claude account, your claude is too old. Update it with curl -fsSL https://claude.ai/install.sh | bash.

Doing it by hand comes down to this. Start the server, then launch Claude Code against it:

ANTHROPIC_BASE_URL=http://localhost:4000 \
ANTHROPIC_API_KEY=sk-local \
claude --model claude-sonnet-4-6

The key is just sk-local. The server never checks it.

Hit your limit? Type exit, keep going

Say Claude Code says "5-hour limit reached" or "You've reached your weekly limit", or your API key comes back with "credit balance is too low", and the reset is hours away.

Type exit in Claude Code, then type keep going. You get a short menu, and the same conversation carries on with whichever model you pick. The options are the models on your machine, sized to your memory, or free cloud models from OpenRouter if you add a free key:

mkdir -p ~/.config/claude-code-local
echo 'OPENROUTER_API_KEY=your-free-key' >> ~/.config/claude-code-local/keepgoing.env

The cloud key is optional. Free cloud models can get busy later in the day, and the models on your Mac are always there.

When your limit resets, just run plain claude again. The install never changes it, so it still uses your Claude plan.

You can also make the switch automatic. Add one hook to Claude Code and the moment you hit your limit, a new window opens in the same folder and carries on without a menu. Setup is in docs/AUTO-HANDOFF.md.

Linux and Windows

Off a Mac there's no MLX, so the model runs on llama.cpp instead. The installer looks at your hardware (NVIDIA, AMD, or just your CPU), grabs a pinned llama.cpp build, and picks a vision model that fits. A 24 GB NVIDIA card gets Qwen 3.5 9B at full BF16, for example.

Linux uses the same one liner as the Mac. On Windows, in PowerShell:

irm https://raw.githubusercontent.com/nicedreamzapp/claude-code-local/main/install.ps1 | iex

You need git, Python 3 and Claude Code installed. Then run claude-local on Linux, or double click Claude Local on your Windows Desktop. keep going works there too.

Private and offline

Your code never leaves your Mac. No cloud model, no tracking, no analytics.

Claude Code itself makes some background calls to Anthropic, so the launchers switch them off with Anthropic's documented settings:

CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
DISABLE_AUTOUPDATER=1
CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL=1
CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1

You can check it yourself. During a session, run:

lsof -a -i -p "$(pgrep -d, -f claude)"

That lists the network connections of every Claude process, and the only one is localhost:4000. Because the model runs on your machine, an Anthropic outage doesn't stop it either.

The one exception is your own choice. If you pick a free cloud model in keep going, that conversation goes to OpenRouter.

Links

The repo: https://github.com/nicedreamzapp/claude-code-local

How to guides and docs: https://nicedreamzapp.github.io/claude-code-local/

The demo: https://www.youtube.com/watch?v=a9vtBSl_j_o

If you run it on an 8 GB or 16 GB Mac, tell us how it goes in issue #57. I especially want to hear from people on older or smaller Macs about which models really fit.

Claude Code Local runs on Linux and Windows now, and it brings the whole kit

Matt Macosko — Thu, 29 Oct 2026 19:07:33 +0000

Back in August someone opened issue #53 on claude-code-local asking for a Windows version. They had an HP laptop with 32 GB of RAM, and the installer stopped them because it only ran on Apple Silicon. I told them the truth at the time. The whole server is MLX native, MLX doesn't exist on Windows, and their RAM was plenty. The chip was the blocker. I said if anyone ported it to llama.cpp I would link it, and nine days later I closed the issue as Mac only.

On October 29 I went back to that thread with a different answer. Claude Code Local runs on Windows now, and on Linux too.

If you haven't seen the project, claude-code-local lets you run Claude Code against an AI model on your own computer instead of the cloud. Your code and your prompts stay on your machine. It's at a little over 3,390 stars on GitHub, and for most of its life it was a Mac thing, because MLX on Apple Silicon is what I run every day. That's still the heart of it.

What changed is the part in the middle. The server that speaks the Anthropic API and translates tool calls used to be tied to MLX. Now that translation doesn't care which engine sits underneath, so MLX and llama.cpp share one code path. On a Mac nothing changes. Off a Mac, the installer checks whether you have an NVIDIA card, an AMD or Vulkan GPU, or just a CPU, downloads a pinned llama.cpp build for it, and picks the strongest vision model that fits your memory at the highest precision it can. A 24 GB NVIDIA card gets Qwen 3.5 9B at full BF16. A 12 GB card gets Qwen 3.5 4B at full BF16. With no GPU at all it sizes a 4B or 9B vision model to your RAM. Every model it can pick reads images, so a screenshot you paste into Claude Code works the way it does in the cloud.

On Windows it's one line in PowerShell, and then you double click Claude Local on your desktop. On Linux it's one line in a terminal and you run claude-local. That was v0.5.0, and I called it Linux and Windows. I posted the PowerShell line in issue #53 and said that if anything breaks on their machine, open a new issue and I'll jump on it.

Less than an hour later v0.6.0 went out, and that's the one I'm actually excited about. I've built a lot of pieces around Claude Code, each in its own repo, and until now they were separate things you had to find and set up yourself. The local model is the brain. The rest give it ears, a voice, hands and reach. So now the installer offers them.

curl -fsSL https://raw.githubusercontent.com/nicedreamzapp/claude-code-local/main/install.sh | bash -s -- --with all

Run it without --with and it shows you a menu once the model is set up. On Windows you set $env:CCL_WITH = "all" before the PowerShell line to skip the menu and get everything.

Here's what's in the menu. Voice is NarrateClaude, so you can talk to Claude Code and hear it answer. Moonstone puts every session on every machine in one window. Browser is the browser-agent broker, which lets agents use your real browser with each one in its own tab. Phone is claude-screen-to-phone, for driving Claude Code from your iPhone. Remote is FiaOS, which gives you your screen and a real terminal from any browser. Failover is claude-failover, which keeps your agents working on a local model when you hit your limit. Terminal is Trinidad Head, a terminal I wrote from scratch in Rust that gives every window its own glow color.

Each one installs through its own repo's installer, so every piece still works on its own if that's all you want. Every repo got an uninstaller too, and removing everything leaves your data alone unless you add the purge flag. A couple of them got smarter about each other along the way. claude-screen-to-phone uses the browser broker now instead of launching its own browser, and claude-failover uses the claude-code-local server when it's already running instead of loading a second model.

The voice piece got the biggest rewrite. NarrateClaude used to lean on Apple's speech recognition, which is why it only worked on a Mac. Now it hears you with whisper.cpp running Whisper large-v3-turbo at full f16 precision, and it answers with a local Piper voice. Instead of typing into Apple Terminal, it runs claude inside a pty the loop owns (ConPTY on Windows), so it works in any terminal. That's what let it go to Linux and Windows the same day. Apple's engine is still there behind a flag if you want it, and everything in the voice loop is open source and runs offline.

So whoever was on that HP laptop can have the model now, and they can also talk to it, watch every session from one window, and hand it their browser. The repo is github.com/nicedreamzapp/claude-code-local. The README already says what's next. Phones are the next frontier, and we're working on it.

My AI Agents Kept Fighting Me for My Own Browser

Matt Macosko — Thu, 29 Oct 2026 08:33:57 +0000

The night they wouldn’t let go of the tab

On the night of October 22 I had AI agents opting me out of data broker and people search sites. They were working in my real Brave, the one I’m logged into everything with, and I was using that same browser right next to them. That was the point. Some of those sites want a captcha or a click only a person can do, so the plan was they do the boring parts and I step in when a human is needed.

It didn’t go like that. The agents kept opening a page, filling part of the form, closing it, and opening it again, over and over in front of me. I’d solve a captcha and the page would reload and wipe it. I’d fill out a form and it would reload and wipe that too. One agent opened a confirmation link right on top of a page I had already submitted. And when they were done, the tabs were still sitting there.

Why they did it

None of this was one bad bug. It was a few habits stacking up.

The agents hop between a hidden copy of a page they work in and a visible copy they show me, and those two copies don’t know about each other. When anything looks off, their fix is to show the page again, and showing it again means loading it again, which wipes whatever I just did. Several agents were acting at the same time. And the big one: they never looked at what the page showed right now before they acted. They acted on what they remembered from a few steps back, so a page I had already finished looked to them like a page that still needed doing.

It isn’t just my setup

Cursor users ran into the same wall. There’s a thread on their forum, Agents use the same browser tab, which creates a conflict, where one agent opens a page, a second agent navigates the same tab somewhere else, and they keep pulling it back and forth. The reply from Cursor called it a known limitation, said parallel agents use the same browser and end up fighting over the active tab, and suggested having one agent use the browser at a time.

That works, but it gives up the thing I actually want. There are plenty of browser agent tools out there. Most of them open a fresh browser with none of your logins, which is useless for anything that needs your accounts. A lot of tools assume the browser belongs to the agent. The rare part is one real browser, logged in, shared safely between a person and several agents at once.

How the tools work now

I already had an open source project for this, browser-agent, and it comes in two parts. The agent does the work: it runs on my own Mac and drives my real Brave. The broker, which lives in the same repo, is what makes it safe to share that browser. It sits on the browser’s debug port and gives each agent its own tab, so agents can’t see or grab each other’s tabs or mine, and it won’t let an agent pull the window in front of me. That night showed the tab rules weren’t enough on their own, so as of this update the two of them work like this.

One tab per job. An agent works in one tab from start to finish and never opens a second copy of the same page. If it needs to show me something, it shows me that tab, not a fresh reload of it.

Look before every step. Before it clicks or types, the agent reads the page as it is right now, not as it was the last time it checked.

Notice when I help. If I solved the captcha or filled in the form, the agent sees that on the page and picks up from there with me instead of starting over.

No reload or close in the middle of a job. This one isn’t left to the agent’s good manners. The broker blocks it in code, so a page I’m working in can’t get wiped out from under me.

Stuck means ask. If something doesn’t make sense, the agent asks me in one line what’s going on. It doesn’t retry by reopening the page, because that’s exactly what was wrecking my work.

And every tab gets closed when the job ends. Hidden work tabs close when the agent lets go of them, and pages it showed me get closed when the task is done, so they don’t pile up across my machines.

Where it is

It’s all on GitHub under the MIT license at nicedreamzapp/browser-agent, with the broker in its own folder there. The broker works with the tools you already use too, since it takes over port 9222 and they keep dialing the same port they always did. If you’ve watched two agents fight over a tab, or watched one reload a page you were halfway through, that’s the problem this is for.

I Had Three Terminals Open All Day. Now I Have One Window I Can Talk To.

Matt Macosko — Tue, 13 Oct 2026 18:30:12 +0000

🖥️Three terminals, three computers

Most days I have three terminals open, each one a Claude Code session, and they live on three different computers: an M5 MacBook, a Mac mini that stays on all the time, and a Windows PC in the shop. A lot of Divine Tribe, my vape business, gets done through those sessions. Orders, shipping, email, the websites, and the apps I build on the side.

The sessions were fine. The screen was the problem. I’m usually in my browser doing orders on my shop dashboard or reading something, and next to it three windows are cooking and scrolling and asking for things. I wanted all of them tucked into a strip on the side of the screen, about a fifth of it, where I could open one up, tell it what I need, and put it back.

The session list on the left, an open conversation on the right. All the screenshots here come from the demo server with made up sessions, not my real ones.

🙅It doesn’t touch my browser

Before anything got built we made a clickable mockup. The first version had a panel that opened pages for me and a terminal that slid over the browser. I said no to both. The browser is mine and I drive it. Moonstone is only the list of conversations and the conversations themselves, in a window I size myself and park next to everything else.

Sessions are grouped by machine and each machine gets its own color. Whatever is waiting on me floats to the top with a NEEDS YOU tag. When I start a new session it picks the computer for me, skipping anything offline and going to whichever one has the least going on, and I can tap a different machine if I want it somewhere else.

Each machine with its GPU and RAM. The star marks where the next session will start.

⌨️Never read only

The first working version showed the sessions I had started in a regular terminal as read only, so I could watch them but not type into them. That didn’t last. I never just want to watch a session. I want to type into any of them from that one window like I’m sitting at that computer, and I want plain answers back, not the pile of commands and code it took to get there.

So now typing into a terminal session moves the whole conversation into Moonstone with its history and closes the old terminal window. When a session wants to run something, it shows up as a card with Allow and Don’t, and nothing gets approved unless I tap it.

A session asking before it runs a command. Nothing is approved on its own.

🎙️Talking to it with my hands full

A good part of my day is packing orders, and I wanted to talk to my sessions while my hands are full. I already had a voice chat called Ohm that reads its answers out loud, and I liked how that felt. I wanted the same thing here.

Every conversation has a mic button. Tap it, talk, then tap it again or hit Enter and it sends. I tried a couple of other ways to do the listening first and none of them felt as instant as the dictation already built into the computer, so that’s what it uses. On a Mac a little helper app turns on the Mac’s own dictation, and on Windows it presses Win+H. Answers get read back in a Kokoro voice running on my own machine. If I have Moonstone open on two computers at once, only the one I touched last does the talking.

The speaker at the top reads each answer out loud. The green mic means it’s listening.

🧠Local models in the same list

Not every question needs Claude. The same list has local models on it: Qwen 3.8 Heretic and Gemma 4 on the M5, and SuperGemma 4 E4B on the PC. I run them at full precision, never squeezed down, so the PC gets the model that actually fits its 32 GB at full size. A local model that sits idle for 30 minutes shuts itself off and gives the memory back, and it starts up again on the next message.

The transcription and the voice run on my own computers too. Each machine runs the same small server that only listens to itself, and they reach each other over SSH tunnels.

🌙Where it is now

It’s one Node file and one HTML file with no dependencies, and it’s meant to replace the Trinidad Head terminals I’ve been using. The code is on GitHub under the MIT license at nicedreamzapp/moonstone, and there’s a page for it with the setup steps on my software site.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Anthropic’s Biggest Backer Just Killed Its Best Model: The Real Story Behind the Fable 5 Shutdown

Matt Macosko — Tue, 29 Sep 2026 18:30:17 +0000

120,000

Characters of system prompt leaked

90 min

Ultimatum to comply

Days from launch to blackout

⏱️The two-minute version

Anthropic launched Claude Fable 5 and Mythos 5 on June 9, the most capable models they had ever shipped. Three days later, on Friday June 12, both models went dark for every customer on the planet. Not throttled, not regionally blocked. Gone.

The reason everyone first latched onto was a famous jailbreaker named Pliny the Liberator, who cracked the model open within a day and posted its entire 120,000 character system prompt on GitHub. That happened, and it is a great story. But it is not why the model got pulled.

The model got pulled because Amazon picked up the phone.

📰What the reporting actually says

According to the Wall Street Journal, Axios, and The Information, Amazon’s own researchers bypassed Fable 5’s safety guardrails internally. They put together a report showing the model could be guided into finding security vulnerabilities across at least four different software programs, the kind of thing that makes a government nervous.

Then Amazon CEO Andy Jassy made a late night call to Treasury Secretary Scott Bessent and other senior White House officials and handed over that report.

From there it moved fast:

Friday morning the White House convened an emergency meeting.
The Commerce Department issued an export control order barring access by any foreign national, anywhere, including foreign national employees inside Anthropic itself.
At 1:30pm Eastern, Anthropic got a 90 minute ultimatum.
By around 10pm that night, global access to Fable 5 and Mythos 5 was shut off.

Because Anthropic had no way to instantly verify the citizenship of every user, the only way to comply with a foreign national ban was to turn the models off for absolutely everyone.

🥶Here is the part that should stop you cold

Amazon is not some rival. Amazon is Anthropic’s single largest investor, somewhere around 8 billion dollars in. They are the cloud backbone Claude runs on through Bedrock.

So the company that pulled the trigger on Anthropic’s flagship launch was its own biggest financial backer. A major investor walked a security report into the White House and got its own portfolio company’s best product taken off the market in a single day.

That is the detail lighting Reddit up right now. Threads across r/ClaudeAI, r/ClaudeCode, r/singularity, r/artificial, and r/neoliberal are all pointing at the same thing: this was not a rogue hacker bringing down a model, this was a boardroom phone call.

🛡️Anthropic says it was never a real jailbreak

For the record, Anthropic disputes the whole premise. Their position is that nobody actually broke their core safety systems. They argue the demonstrations were just coaxing the model past its conversational refusals, not defeating the independent classifiers that do the real safety work. They say some of the outputs being passed around did not even come from Fable 5, and that the so called exploit was basically the model doing its intended job, reading a codebase and pointing out bugs.

Anthropic called the government’s read of the situation “a misunderstanding” and pushed back on the idea that one narrow potential weakness should be grounds for yanking a commercial model used by hundreds of millions of people.

🔓So who jailbroke Fable 5?

Both, in different ways, and that is why the story got scrambled.

Pliny the Liberator did the loud public version. He always does, usually within hours of any major model launch. That is the one that went viral.

Amazon’s researchers did the quiet version, the one with a report and a phone number for the Treasury Secretary. That is the one that actually ended the model.

If you saw someone say “Amazon jailbroke Fable,” that is not quite right and not quite wrong. Amazon’s people did bypass it, and Amazon’s report is what killed it. Pliny’s stunt was a separate event running in parallel.

🏠Why this matters if you actually depend on AI

Strip away the drama and the lesson is the same one I keep coming back to. The most powerful AI on earth was switched off in a single afternoon. Not by a bug. Not by a hacker. By a combination of one investor’s phone call and one government order.

If your workflow lives entirely in someone else’s cloud, your access is a guest pass. It can be revoked by a memo, quietly degraded without notice, or caught in the crossfire between a lab, its investors, and Washington. None of those three are working for you.

A model running on hardware you own does not get suspended by an export order. It does not get downgraded the day you need it most. It is slower and it is dumber than the frontier stuff, and it is still yours, and it is still running tomorrow.

🔑That is the whole argument for keeping some of your intelligence local. Fable 5 just proved it twice in one week.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Hermes-4-14B Abliterated, MLX 4-bit — Apple Silicon Just Got Another Real Model

Matt Macosko — Thu, 24 Sep 2026 18:30:09 +0000

16 GB

Mac it runs on

~1,000

Downloads per model / 30 days

~1 hr

From git pull to upload

📦What it is

Hermes 4 is NousResearch’s instruction-tuned model family. The 14B variant is built on Qwen3, so it inherits Qwen3’s tokenizer, chat template, and architectural quirks — but the post-training is pure Hermes, which means it’s tuned for tool use, role-play, structured output, and not refusing benign-but-edgy questions.

Babsie’s abliteration applies refusal-direction projection per Arditi et al. (2024) to the BF16 weights, which suppresses the model’s built-in refusal vector. Plain English: the model will answer questions that the upstream Hermes would politely decline. You become the moderator.

My contribution is the boring-but-useful part: convert those BF16 weights to MLX, quantize to 4 bits with group size 64, ship.

🍏Why this matters for Mac users

14B is the sweet spot on Apple Silicon. Big enough to be genuinely useful for instruction-following, small enough to fit comfortably in 16 GB of unified memory at 4-bit, and tiny enough on disk that you can keep a half-dozen variants without thinking about it.

For comparison:

🦙 Llama 3.3 70B 8-bit MLX

(also on my Hugging Face) — 75 GB, needs a 96 GB machine

💎 Gemma 4 31B 4-bit MLX

17 GB, runs on any 32 GB Mac

⚡ Hermes 4 14B 4-bit MLX

8 GB, runs on a 16 GB Mac, snappy on anything bigger

If you have an M-series Mac and you want a capable instruction-tuned model that doesn’t refuse benign requests and doesn’t phone home, this is the easiest install on the list.

🛠️How to run it

The mlx_lm package does all the heavy lifting. From a terminal:

pip install mlx-lm

Then, in Python:

from mlx_lm import load, generate

model, tokenizer = load("divinetribe/Hermes-4-14B-abliterated-4bit-mlx")

messages = [{"role": "user", "content": "Write a haiku about local inference."}]
prompt = tokenizer.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)

response = generate(model, tokenizer, prompt=prompt, max_tokens=256)
print(response)

Or as a server, using mlx-lm’s OpenAI-compatible endpoint:

mlx_lm.server --model divinetribe/Hermes-4-14B-abliterated-4bit-mlx --port 8080

That gives you a local http://localhost:8080/v1/chat/completions endpoint that any OpenAI SDK client can hit. No tokens, no API bills, no telemetry.

🧩Where it slots into the local-first stack

I maintain claude-code-local on GitHub — a project that lets you run Claude Code 100% on-device using local MLX models in place of the Anthropic API. Hermes 4 14B abliterated is now a supported backend, sitting between Gemma 4 31B (the everyday workhorse) and Llama 3.3 70B (the heavy lifter) in terms of size and speed.

For workflows where refusals are noise (security research, fiction with edge, prompt-engineering experiments where the same prompt needs to hit both refusing and non-refusing models for comparison), the abliterated variant saves a lot of re-prompting.

📤Why I publish these

From where I sit, the Apple Silicon community is underserved on model variety. The big quantization shops mostly target llama.cpp and GGUF, which is fantastic for Linux/Windows GPU workflows but adds a translation layer on Macs. MLX is Apple’s own framework, and when a model lands in MLX format the experience on a Mac goes from “this works” to “this is what the hardware is for.”

So a few times a month, when a hot new model drops, I take the abliterated BF16 (if a trusted shop has done the abliteration upstream) and run it through mlx_lm.convert. Takes about an hour from git pull to huggingface-cli upload. Costs me ~80 GB of disk during the build and ~8 GB to keep around.

The downloads page tells me people are finding them. Llama 3.3 70B 8-bit MLX and Gemma 4 31B 4-bit MLX each pull ~1,000 downloads every 30 days, almost entirely from Mac users running them through mlx-lm or claude-code-local. Hermes 4 14B should be more accessible than either, since 16 GB Macs are everywhere.

🔮What’s next

I’m watching for the BF16 abliterated source of DeepSeek V4 Flash to drop publicly. The GGUF version (cyberneurova/CyberNeurova-DeepSeek-V4-Flash-abliterated-GGUF) already has 86 K downloads, but the BF16 source isn’t published yet — the moment it lands, I’ll be the first to ship an MLX 4-bit. DeepSeek V4 Flash on Apple Silicon at ~140 GB is going to be a moment for people with 128 GB+ Macs.

🎁Until then: enjoy Hermes 4 14B. The model card has the full install recipe and a benchmark snippet.

🔗Links

Model on Hugging Face: divinetribe/Hermes-4-14B-abliterated-4bit-mlx
Source: Babsie/Hermes-4-14B-BF16-abliterated
All my MLX models: huggingface.co/divinetribe (or the showcase page at nicedreamzwholesale.com/software/huggingface/)
Local Claude Code: github.com/nicedreamzapp/claude-code-local
AirGap — what the full private build looks like for compliance-sensitive firms; the whole stack is open source

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

I Took Down Six of My Own Benchmark Videos. Then I Built the Local Agent Leaderboard.

Matt Macosko — Tue, 22 Sep 2026 18:30:07 +0000

64 s

Local easy-suite time vs 122 s cloud

Checks every judge must pass first

Per token on my own hardware

🕵️I caught my own judge lying

My benchmarks are filesystem-judged: the model does real work in a sandbox — create the file, fix the failing test, rename a function across files — and a script checks the artifacts afterward. The model’s opinion of its own work is never consulted. I thought that made the scores bulletproof.

Then I built a validation gate: before any judge is allowed to score a model, it has to pass a known-good reference solution and fail a plausible known-bad one. Twenty tasks, forty checks. Nineteen judges passed. One didn’t.

The hard-suite cache task (build an LRU cache with per-item TTL) had a probe that asserted an eviction order its own spec forbids. I wrote a spec-perfect solution by hand and the judge failed it. Which means both models in my published video had been scored down by a bug in my test. The video said 6/8 and 6/8. The truth, under the repaired judge: 7/8 for Qwen3-Coder and a perfect 8/8 for Qwen3.6. My broken test made both models look worse — that’s the lucky direction of this failure, and it still wasn’t good enough to leave up.

Judges are code. Code has bugs. If a benchmark has never tested its own judges, it’s a random number generator with a nice table.

🏟️So I built the league

Agent-12 is a public leaderboard for the question r/LocalLLaMA asks every single week: which model can actually be my agent on my own hardware? Not trivia scores. Twenty sandboxed agent tasks — 12 everyday chores, 8 hard reasoning problems — judged only by what lands on disk. Temperature 0, fixed step caps, fresh sandbox and fresh conversation per task, hash-pinned test files so a model that “fixes” a failing test by editing the test scores zero.

And the part I now consider non-negotiable: every judge is validated against known-good and known-bad reference solutions before it scores anything, and every model runs the full gauntlet three to four times. A lucky run counts for nothing. The repo — tasks, judges, runner, validation gate, methodology — is open, and any agent CLI can plug into the same tasks through a generic adapter.

🥊Day one: five local fighters, one cloud yardstick

All local rows ran on one Apple M5 with 128 GB unified memory, through my lean ~550-token terminal engine.

Model	Easy (12)	Hard (8)	tok/s	Notes
Qwen3.6-35B 👑	12/12	8/8	46	Perfect in every sweep. Champion.
Qwen3-Coder-30B	12/12	7/8	84	Fastest. Fails the same parser task every run.
Gemma 4 31B	11–12/12	7–8/8	26	Scores wander between runs.
DeepSeek V4 Flash (2-bit, 0731)	12/12	8/8	8	284B MoE. Perfect, but patient work.
DeepSeek V4 Flash (original)	Beaten by the 0731 update in every category. Deleted — 81 GB freed. The league has cuts.

The repeat runs earn their keep. Qwen3-Coder failing the same task three sweeps in a row is a reproducible fingerprint you’d never see in a single-run benchmark. Gemma’s misses moving around between runs is a stability finding in its own right.

😮The row that surprised me

I ran Claude — the frontier cloud model — through the same engine, same tasks, same judges, as a clearly-labeled reference point. It went a perfect 20/20. So did my local champion. And on wall-clock, the local model won: 64s vs 122s on the easy suite, 125s vs 131s on the hard suite (cloud times include network round-trips — which is the honest end-to-end experience of using it).

That’s not a claim, it’s a row on a public board with the runner that produced it.

⚙️The harness is half the story

One more result, because it’s the reason this board exists. The same Qwen3.6 that goes 20/20 in my lean terminal engine spent an hour in a 32,000-token thinking spiral inside a heavyweight agent harness (7,800-token system prompt, 66 tools) and produced zero files. Same weights. Same machine. The harness was the only variable.

The ecosystem is currently running the other direction — plugging local models into big cloud-grade harnesses and blaming the model when it chokes. There’s fresh academic backing for harness-model matching mattering this much (AgentMeter, arXiv 2606.21140) — but it was measured on cloud CLIs. Nobody was measuring it on hardware you can buy. Now somebody is.

🔮What happens next

Every new model that drops gets a row and a fight video. The board lives at nicedreamzapp.github.io/agent12, the code at github.com/nicedreamzapp/agent12. If you think your favorite model belongs on it, tell me — it’ll get the same twenty tasks, the same validated judges, and the same number of chances to prove it wasn’t luck.

👑A 35B model on the Mac on my desk tied the cloud on score and beat it on time, at zero dollars per token.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

The Heppner Ruling, Warner v. Gilbarco, and What Confidential AI Actually Has to Mean

Matt Macosko — Thu, 17 Sep 2026 18:30:08 +0000

This article describes a recent federal court ruling and what it implies for confidential AI use. It is not legal advice. Talk to your bar counsel before changing any firm policy.

3 sec

To verify with lsof -i

31B

Params a firm can run on-device

$400/hr

The attorney who won’t take the weekend

📜What the ruling actually says, and what it does not

Heppner is about a client — not a lawyer — who used a public AI tool on his own, after indictment, and then handed the output to his lawyers. The court held that the client’s own act of transmitting prompts to a public platform destroyed any expectation of confidentiality. Receiving the output later did not cure that.

It is not a blanket holding that all AI-assisted legal work loses privilege. The same month, in Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), a federal court denied a motion to compel disclosure of AI-assisted internal analysis and drafting, holding that the work-product doctrine still applied.

The split is not about whether AI is allowed in legal work. It is about where the AI runs and who sees the data along the way.

⚠️ Public, third-party-hosted AI

Used by a client or counsel. Heppner-style transmission risk to privilege. The contract may help but does not physically prevent transmission.

✅ Internal / on-device AI (privilege intact)

Used by the firm for its own work-product, where data never leaves the firm. Warner-style work-product protection still applies.

🔀The two real categories of “private AI” in 2026

☁️ Cloud with contractual ZDR

Spellbook, Harvey, CoCounsel. Pitch: we do not train on your data, contract says so, here is the DPA. Heppner weakens the simple version of the argument; the contract still has to survive scrutiny.

🖥️ On-device

The language model runs on a Mac or PC inside the firm. Outbound network traffic blocked at the firewall. The data is not transmitted because there is no transmission. Verified with lsof -i.

Both categories have legitimate use cases. They are not the same product. After Heppner and Warner read together, they are not the same risk profile either.

🔒Why physical beats contractual for genuinely privileged work

A contract is a promise that something will not happen. A network configuration is a constraint that prevents something from happening.

When Judge Rakoff examined the public AI platform’s terms in Heppner, he was assessing a promise. When you point bar counsel at a Mac running locally with the Wi-Fi physically off and lsof on screen, you are showing them an absence of transmission. That is a different evidentiary category. It is also a verifiable one. Any partner, paralegal, IT vendor, or auditor in the firm can run lsof -i themselves and see whether a network connection is open. The check takes three seconds. It does not depend on trusting a third party’s audit.

⚖️What on-device AI is good at, and what it is not

✅ Good at

NDA and contract review against template clauses
Document summarization
Drafting against your own document library, with citation-checking against your corpus
Daily briefings on what changed in matter folders overnight
Plain-English Q&A over a firm’s own document set

❌ Not as good at

Real-time legal research against current case law (the model knows what it was trained on; it does not search Westlaw)
Tasks that genuinely require frontier cloud-model capability (on-device frontier is roughly a 70B model in 2026)
Workflows where current online context is the whole point

A realistic implementation uses both: on-device for the privileged work, cloud-with-care (with a DPA, with a written firm policy) for the public research.

🗓️What a small firm can actually do this week

Write down which matters have had documents touched by public AI tools. You may need this if discovery ever comes for the AI-generated work product.
Update your firm’s AI policy to differentiate between research (cloud OK with care) and privileged document work (on-device, or contractual ZDR with eyes wide open about Heppner-style risk).
Pilot on-device for the small, repeatable, privileged tasks first: NDA review, contract summary, intake document analysis, daily briefings.

The hardware to run on-device AI privately in 2026 is a Mac mini or MacBook Pro with Apple Silicon. The open-source software stack to run a 31-billion-parameter language model on either is freely available. The total setup time for a technical person is a weekend. The total setup time for a $400-an-hour attorney is also a weekend they will never take.

✍️On that note

I run a small business in Arcata, California, and this exact stack runs it every day. I used to sell a pre-configured version of it, the AirGap Box. I have since retired that as a product. The whole stack is open source, and a competent IT person can stand it up from my repos in a weekend without ever talking to me. That is the point of open source, and honestly it is a better answer for a compliance-minded firm than buying a box from any vendor, me included.

What I offer now is simpler: if your firm wants a system like this built and your team trained on it, email me and we will talk about whether it makes sense. Here is what a full build looks like.

You can watch a live lsof-on-screen demo of an NDA being reviewed on a laptop with Wi-Fi physically off, on YouTube, before deciding anything.

If you are a partner, a managing attorney, or an IT lead at a firm trying to figure out what Heppner and Warner mean for your firm’s AI policy, my email is info@nicedreamzwholesale.com. No sales pitch. I will tell you honestly whether on-device makes sense for your firm before I would let you buy anything from me.

⚖️The point of Heppner is not to forbid cloud AI. It is to stop pretending cloud AI is the same thing for both kinds of work.

— Matt Macosko

Nice Dreamz LLC

Arcata, California

Sources for the cases discussed:

K&L Gates, “Litigation Minute: Generative AI Data, Attorney-Client Privilege, and the Work-Product Doctrine” (Feb. 23, 2026)
Wealth Management, “Attorney-Client Privilege Waived by Client’s Use of Public AI” (2026)
United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026)
Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026)

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

A Federal Order Switched Off Anthropic’s Best AI Overnight — and Made the Case for Private AI

Matt Macosko — Tue, 15 Sep 2026 18:30:10 +0000

Update: The fuller, verified story is here: Anthropic’s biggest backer just killed its best model.

90%

Score on hard benchmarks

72 hrs

As the most powerful public AI

60×

Longer data retention if you opt in

🗓️The timeline

June 9, 2026 — Anthropic launches Fable 5 (and its larger sibling, Mythos 5) as its most capable public models, scoring around 90% on hard benchmarks and getting wired into AWS, Snowflake, and GitHub Copilot almost immediately.
June 10 — Pliny the Liberator (@elder_plinius on X) posts a “FABLE-5: LIBERATED” thread claiming to have bypassed the model’s safety classifiers, and publishes its system prompt to GitHub.
June 11–12 — A separate, quieter controversy catches fire: Fable 5 was silently routing flagged requests to a weaker model without telling users.
June 12, 5:21pm ET — Anthropic receives a U.S. government export-control directive ordering it to suspend access to Fable 5 and Mythos 5. That evening, both models go dark worldwide.

🏛️What the government actually ordered

The directive came through the Commerce Department’s export-control authority, reportedly from Commerce Secretary Howard Lutnick to Anthropic CEO Dario Amodei, and it cited national-security concerns. Axios framed it as the Trump administration moving to block foreign access to America’s most powerful AI.

The mechanism is what turned a narrow order into a total blackout. The directive bars access by any foreign national — inside or outside the United States, including Anthropic’s own non-citizen employees. There is no clean way to guarantee that no foreign national ever touches a hosted model except to switch it off for everyone. So that’s what Anthropic did. In its own words:

“The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Claude models is not affected. We believe this is a misunderstanding and are working to restore access as soon as possible.”

🔓The jailbreak: a real event with an inflated headline

The trigger the government pointed to was a “jailbreak” — specifically, a technique that lets the model read through a codebase and identify software flaws quickly. The X timeline and the facts don’t line up as neatly as the screenshots suggest, so it’s worth slowing down here.

What’s genuinely true: Pliny published Fable 5’s system prompt to GitHub and bypassed its safety classifiers using known methods — Unicode character substitution and prompt fragmentation, where you break a request into pieces the classifier reads as harmless. Major outlets covered it. That part is real red-team work.

What’s overstated is the “ANTHROPIC: PWNED” framing. As one level-headed write-up put it, “the news is real, but ‘PWNED’ is marketing.” Bypassing a classifier is not the same as owning the model. Fable 5 went through more than a thousand hours of safety testing, no universal jailbreak was demonstrated, and the scariest claimed outputs were never independently verified by a neutral party. Pliny himself called Fable 5 “one of the most disappointing model drops of all time” — but that opinion landed in the same news cycle the model was scoring 90% on benchmarks and shipping into enterprise stacks.

🕵️Who is Pliny the Liberator?

If you’re new to this corner of the internet, it’s worth understanding why one anonymous account can move a story this big — because a lot of people on X are convinced he’s the reason the model got pulled.

Pliny the Liberator (the handle nods to Pliny the Elder) is an anonymous personality who has, in a short time, become the most visible jailbreaker in AI. TIME named him one of the 100 most influential people in AI in 2025. He has more than 100,000 followers on X and runs a Discord community called BASI — short-formed from “BASI PROMPT1NG,” launched back in May 2023 — where north of 20,000 members workshop techniques together. He reportedly came in with no prior coding background, and built the reputation purely on pattern-watching, creativity, and relentless practice.

His output is prolific and public. He puts out a “liberation bulletin” for practically every new model — GPT, Grok, Gemini, Claude — usually within hours of release. He maintains open repositories that have become reference material for the whole scene: L1B3RT4S (“jailbreaks for all flagship AI models,” flying the #FREEAI and #LIBERTAS banners), CL4R1T4S (a collection of leaked or extracted system prompts from the major labs), and projects like G0DM0D3, a fully unguarded chat interface with the methodology open-sourced. He also leads BT6, a roughly 28-operator white-hat collective built around radical transparency and open-source AI security.

🎭The strange part: a jailbreaker can be a lab’s best marketing

Here’s the paradox at the heart of this, and it’s one of the most interesting things about the whole episode. You’d assume the labs hate Pliny. The reality is more complicated, and in some ways he’s one of the best things that happens to a model launch.

When a million people are talking about your model being “liberated” within hours of release, that is, perversely, enormous attention on your model. He has received an unrestricted grant from venture capitalist Marc Andreessen, and has taken short-term contracts with top labs — OpenAI among them — to make their systems more robust. That’s the tell: the same labs whose guardrails he breaks also pay him to break them, because every jailbreak he publishes is a free stress test. There’s an entire essay floating around titled “Please Jailbreak Our AI,” and it isn’t satire — it’s describing the actual incentive. Frontier labs hire people like Pliny to find the holes, then train the next model to resist what they found.

So is he a security researcher, a folk hero, or a hidden marketing engine for the same companies he taunts? Honestly, he’s all three at once, and that ambiguity is exactly why he commands the attention he does. It also cuts the other way: when your jailbreaker is that visible, and a model gets pulled by the government 48 hours after he posts, of course the internet draws a straight line — even if the real story is messier.

🌊And he is far from alone — the scene is moving fast

Pliny is the famous face, but the thing people miss is how organized and fast-moving the broader community has become. This isn’t a lone hacker in a basement; it’s a maturing field with competitions, games, conferences, and labs quietly funding all of it.

🏆 HackAPrompt

and similar outfits run public jailbreaking competitions, and the prompts contestants submit become training data the labs use to harden their models. The adversaries are, in effect, an unpaid (or prize-paid) red team.

🧙 Lakera’s “Gandalf”

— a prompt-injection game where you try to trick an AI into revealing a password — has become a rite of passage that pulls newcomers into red-teaming in the first place.

🎪 DEFCON’s AI Village

and a constellation of Discords have turned adversarial testing into a community sport with shared methodology and a real on-ramp for talent.

The speed is the headline. Models are now reliably “liberated” within hours of launch, not weeks. Each release becomes a public race, and the techniques compound — Unicode tricks, multi-agent decomposition (splitting a forbidden task across several cooperating prompts), narrative framing, system-prompt extraction. What used to be folklore is now documented, versioned on GitHub, and taught. That acceleration is a big part of why a government would look at a three-day-old model and decide the capability was already loose.

🛡️Anthropic’s side — and it’s a strong one

Anthropic didn’t just comply quietly; it pushed back. The company says the directive arrived with no specific technical detail, and that when it reviewed the demonstration, the “jailbreak” amounted to “a small number of previously known, minor vulnerabilities.” It described the issue as “narrow” and “non-universal,” and pointed out that the capability in question — “asking the model to read a specific codebase and fix any software flaws” — “is widely available from other models (including OpenAI’s GPT-5.5).”

Then the line that should give every builder pause:

“If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.”

Anthropic added that it disagrees “that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people.” Whatever you think of the company, that’s a serious argument: if a narrow, already-public capability can pull a frontier model off the market by government order three days after launch, that’s a precedent with a very long shadow.

📉The scandal underneath the scandal: silent downgrades

This is the part I keep coming back to, because I lived a version of it. Lost in the jailbreak noise was a separate complaint that, to a lot of researchers, mattered more: Fable 5 was silently handing flagged requests to a weaker model — Opus 4.8 — without telling users. No warning, no fallback message, just quietly worse answers for anyone the system suspected of doing sensitive work, or, in some accounts, of building competing AI systems.

The AI researcher Nathan Lambert summed up the objection sharply: “An AI model that automatically becomes less intelligent without telling me is categorically misaligned AI.” That’s the real transparency failure — not that a model has guardrails, but that it can swap itself for a dumber version mid-task and let you keep trusting the output. Anthropic apologized for this specific behavior and has since made the downgrades visible and started surfacing refusal reasons in the API.

I find it striking that the thing I personally noticed on June 11 — getting moved to Opus 4.8 with no real explanation — turned out to be one of the most legitimate grievances in the whole episode. The jailbreak got the headlines and the government order; the quiet downgrade is what actually broke trust.

👁️The quieter fear: are they watching, and training on what you tell them?

That suspicion — that the model is silently profiling what you’re up to and demoting you if it doesn’t like the look of it — connects to a bigger anxiety that’s been building all over X: that the labs are watching their users and absorbing their ideas. With Anthropic, this isn’t pure paranoia; there’s a documented basis worth understanding.

Anthropic spent years positioning itself as the privacy-first lab. That posture has shifted. Consumer conversations are now used to train future models unless you actively opt out, and the opt-in setting stretches data retention from 30 days to five years — a sixtyfold increase in how long your chats sit in the training pipeline. The part that fuels the spying narrative most: a clause in the privacy policy updated June 8, 2026 makes clear the opt-out has a ceiling. Conversations that Anthropic’s systems flag for safety review can still be used to train its models, regardless of your stated preference. The policy doesn’t define what trips a safety flag, and it doesn’t commit to telling you when one happens.

Put those two facts next to each other — a model that silently demotes users it suspects of building competitors, and a policy that lets flagged conversations be trained on no matter what you chose — and you can see why a lot of people feel watched. I want to be fair: “your data may train future models if flagged” is not the same as “they are stealing your specific ideas to build products against you,” and I haven’t seen proof of the stronger claim. But the gap between Anthropic’s old privacy-first brand and these new carve-outs is real, it’s documented, and it’s a big reason the trust conversation has gotten so heated this week.

🧵So why did people on X think it was all because of Pliny?

Because the timing is irresistible: the most famous jailbreaker alive posts “FABLE-5: LIBERATED,” and 48 hours later the government pulls the model. A million-strong audience connected those two dots into a straight line — “one tweet got the model banned.”

I don’t think the honest version is that clean. The documented cause is a federal export-control order citing a codebase-vulnerability capability, and Anthropic says that capability is narrow and already available elsewhere. Pliny’s post is the same genre of jailbreak in the same news cycle, and it’s reasonable to think the public red-team scene — him included — is part of what put this capability on the government’s radar in the first place. But “the jailbreak community drew official attention” and “a single tweet got an AI banned” are different claims, and only the first is really supported. I’d rather hand you the real shape of it than a tidy story that doesn’t hold up.

🧭The lesson, from where I sit

Strip away the drama and one fact remains: for about 72 hours, Fable 5 was arguably the most powerful general-purpose AI available to the public. Companies paid for it. People built it into production workflows and agent pipelines. Then, with a single order on a Friday evening, it was gone — refunds on the way for a product that simply vanished.

Nobody running a local, private AI model lost a thing that night.

That’s the whole point, and it’s not a coincidence. When your intelligence lives on someone else’s servers, it’s subject to their terms, their classifiers, their uptime — and, as we just watched in the clearest possible way, to government orders that can land overnight and have nothing to do with anything you did. Your model can be switched off, quietly swapped for a weaker one, or quietly learning from your conversations, all decided by people who have never heard of your business. Enterprise reaction to the shutdown has been a fast pivot toward exactly this realization: teams whose entire workflow was tied to one closed API just learned how fragile that is, and they’re scrambling to diversify.

I’m not anti-cloud. The frontier models are extraordinary and I use them every day. But the Fable 5 shutdown is the strongest argument I’ve seen yet for keeping a private-AI backup plan: capable open-weight models running on hardware you control, where the off switch is in your building and not in someone else’s compliance department, where the model can’t silently demote itself without you knowing, and where your work isn’t quietly feeding someone else’s next product. For firms in compliance-sensitive fields — law, medical, finance — where losing access, getting a degraded answer, or leaking sensitive context is a real liability, that isn’t paranoia. It’s just continuity planning.

The cloud models may well come back. Anthropic believes this is a misunderstanding, and I hope it’s right. But the lesson holds whether Fable 5 returns next week or not: if losing access to an AI — or unknowingly getting a dumber one, or quietly handing over what you feed it — would hurt your operation, some of that intelligence should live where nobody but you can turn it off.

📌The bottom line

Frontier cloud models are extraordinary — and entirely revocable. The Fable 5 blackout proved that access, model quality, and even the privacy of what you type can change without warning, by a decision made far outside your business. Keeping some of your intelligence on hardware you own isn’t about distrust of the cloud; it’s continuity planning.

🔌The off switch should be in your building.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Why I Quantize Open-Weight Models for Macs — And Why Your Law Firm Should Care

Matt Macosko — Thu, 10 Sep 2026 18:30:07 +0000

Why I Quantize Open-Weight Models for Macs — And Why Your Law Firm Should Care

2,664

GitHub stars on claude-code-local

~8 GB

Size of the new Hermes 4 14B quant

16 GB

Mac it runs on

I publish a few MLX quantizations a month under huggingface.co/divinetribe to close that gap. Two of mine have crossed 1,000 downloads in the last 30 days. The latest, Hermes-4-14B-abliterated-4bit-mlx, shipped today.

The downloads tell me something I already suspected: there is real, sustained demand for capable models that run entirely on Apple Silicon. And I think the most interesting buyers are not who you’d guess.

💻The hobbyist case is easy

Mac developers want models that “just work” on their hardware. MLX uses Apple’s unified memory and Metal Performance Shaders. When a model lands in MLX format, inference goes from “this works through a compatibility shim” to “this is what the hardware was built for.” Tokens-per-second jumps. Battery drain falls. The fan stays quiet.

That’s fine. That’s the easy demand to serve. Hobbyists, indie developers, students with M1 MacBook Airs. The downloads come in steady, and the audience expands a little every quarter.

Here’s the part nobody talks about.

⚖️The interesting case is law firms

If you’re a partner at a law firm handling NDAs, M&A docs, IP filings, sealed depositions — anything privileged — sending that content to OpenAI, Anthropic, or Google for “AI summarization” is, depending on your jurisdiction, somewhere between professionally negligent and outright disqualifying. The terms-of-service for every major cloud LLM provider explicitly retain the right to log your prompts. Many train on them. The opt-outs are partial at best and legally untested at worst.

So firms either:

Pretend AI doesn’t exist (most do, currently)
Run an on-prem private cloud (six-figure setup, IT-heavy, hardware refresh every 18 months)
Use one of the “enterprise-grade” SaaS LLM wrappers that promises not to log (the promise is contractual, not technical)

Or — and this is the option that almost nobody is talking about — you put a MacBook Pro on the partner’s desk, install a local LLM, point a chat client at localhost:8080, and the document never leaves the machine. Network-disconnect the laptop entirely during sensitive work, and you have a literal air gap. The prompt and the response live on a single piece of silicon owned by the firm.

That’s not theoretical. I’ve built that exact stack — it’s AirGap, what the full private build looks like: claude-code-local (the on-device Claude Code replacement, currently 2,664 stars on GitHub) running on a firm-owned MacBook, with verified network audits proving nothing leaks. The whole stack is open source. The models that run inside it are exactly the ones I publish on Hugging Face — Gemma 4 31B for everyday work, Llama 3.3 70B for harder reasoning, and now Hermes 4 14B for instruction-following without refusal noise.

The legal sector is the obvious first market, but the same pitch works for any field where confidentiality has teeth: medical records, due diligence, journalism source protection, internal investigations, M&A under embargo, defense contracting. Anywhere “your prompt cached on someone else’s server” is a deal-breaker, an on-device MLX model is the answer.

🔍Why open weights specifically

A cloud LLM is a black box. You send a prompt, the answer comes back, you trust that the provider isn’t reading or training on it. The trust is enforced by a terms-of-service document and a privacy policy. If those change, your only recourse is to stop using the service. The content you already sent is, presumably, gone — but you have no way to verify.

Open weights flip that around. The model file lives on the firm’s hardware. The firm’s IT team can inspect every byte. Network monitoring tools can confirm that no inference traffic leaves the building. The model is auditable in a way no SaaS API will ever be. If the underlying open-weight model gets pulled from Hugging Face tomorrow, the firm’s copy keeps working forever.

That permanence — the fact that today’s open model is also next decade’s open model, as long as someone keeps a copy — is the part of the pitch that I think clinches it for compliance officers.

🧪What you can do with this

If you’re a developer with a Mac, grab Hermes-4-14B-abliterated-4bit-mlx and try it. It’s ~8 GB, runs on a 16 GB Mac, and the install is pip install mlx-lm plus three lines of Python. The model card has the recipe.

If you’re a partner, IT director, or in-house counsel at a firm that handles privileged content, AirGap is what the full private build looks like — the path from “we’re worried about AI confidentiality” to “we have a verified on-device setup,” network audit included, with the whole stack open source.

If you’re a researcher or quant who wants the next model on Apple Silicon before anyone else has it, follow divinetribe on Hugging Face. The release cadence is irregular but the targets are deliberate — I publish what I’d actually want to use.

🚫What this is not

I’m not anti-cloud. The frontier models from Anthropic and OpenAI are genuinely better at the hardest reasoning tasks, and for non-confidential work the cloud is the right default. I use Claude every day for my own coding.

I’m also not promising that local-first is free. There’s a real cost to running serious local inference: hardware, electricity, the time to keep the stack updated. For most workflows the cloud is cheaper.

But for the cases where confidentiality is non-negotiable — and there are more of those than the AI industry currently admits — local-first is the only honest answer. Open weights, Apple Silicon, MLX. That’s the stack. I’ll keep publishing pieces of it on Hugging Face for as long as the downloads tell me people are using them.

🔗Links

The new model: Hermes-4-14B-abliterated-4bit-mlx
All MLX models I maintain: huggingface.co/divinetribe
Showcase + cross-links: nicedreamzwholesale.com/software/huggingface/
On-device Claude Code: github.com/nicedreamzapp/claude-code-local
The full private build: AirGap

🔐You can’t subpoena Anthropic for a prompt you ran on your own MacBook in 2026.

Whose work this stands on

Quantizing a model is the last mile. Almost everything that makes it possible was built by other people and given away.

MLX and mlx-lm — Apple’s ml-explore team. The framework that makes Apple Silicon a serious place to run models at all.
Gemma (Google DeepMind), Llama (Meta) and Qwen (Alibaba) — the open weights everything downstream depends on.
Maxime Labonne — wrote up the abliteration technique clearly enough that the rest of us could use it.
huihui-ai and Babsie — the abliterated models I quantize from.
Hugging Face — for hosting all of it, free, at a scale that would bankrupt most of us.

If your work is listed here and you would like the wording changed, write to me and I will fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

Two AI Agents, One Browser Window: What Actually Breaks, and What Doesn’t

Matt Macosko — Tue, 08 Sep 2026 18:30:06 +0000

6×

LinkedIn’s compose box vanished

CDP commands fired — focus never moved

Lines to test it on your own setup

🚨The symptoms

I was posting a technical write-up to a few places. Three things went wrong, and none of them looked related.

Text arrived twice. I’d insert a paragraph into a rich text editor and get the paragraph twice, concatenated. On Reddit this was worse than cosmetic: the doubled insert swallowed my paragraph breaks, and the editor’s autolinker then fused words across the missing breaks. “forward passes.” followed by “so i wrote” became a link to passes.so. My repo URL got welded to the next word and turned into a dead link. On a launch post.

A modal opened, then vanished. LinkedIn’s compose box would open, and by the time I went to type into it, it was gone. Six times.

Then it worked first try. I asked my partner to pause the other agent. The very next attempt went through perfectly.

🙈The wrong conclusion

I had notes from months earlier saying LinkedIn’s compose UI is hard to automate and is best done by hand. So when it failed six times, I had a ready-made explanation and I took it. I even wrote it down again as confirmation.

That’s the part worth sitting with. The evidence for “LinkedIn is hard to automate” and the evidence for “something else is driving this browser” are identical from inside one agent. I picked the explanation I already believed.

The doubled text should have tipped me off much earlier. No amount of website hostility makes your own execCommand run twice.

🔀What’s actually going on

Two separate things get called “agents fighting over the browser,” and conflating them is why people build the wrong fix.

🧭 Problem one: tab routing.

Most browser tooling has a notion of “the current page.” Two agents both calling “open a page” and “act on the current page” end up pointed at the same tab. Agent A opens a modal, agent B navigates that tab, and A’s next call lands somewhere unrecognizable. This is what was actually happening to me.

🪟 Problem two: focus stealing.

Trusted input — a real mouse click, a real keystroke — only lands in the tab the operating system has focused. There’s exactly one of those. And for a long stretch, CDP commands on macOS yanked the window forward as a side effect, even read-only ones, which meant an agent working in the background would rip your window out from under you mid-sentence.

I assumed I had both problems. I had one.

🛠️Fixing routing

chrome-devtools-mcp already ships the fix, and it’s off by default:

--experimentalPageIdRouting

It exposes a page ID on page-scoped tools and routes each request by that ID instead of a shared “currently selected” pointer. Each agent addresses its own tab explicitly. Same window, different tabs, no collisions.

One gotcha worth checking before you restart everything: if you pin the tool version, confirm your pinned version actually has the flag. I was on 1.1.1 while latest was 1.6.0. It happened to be supported there, but a silently-ignored flag would have meant restarting both agents and drawing conclusions from a config that was never live.

After turning it on, I drove tab 2 while tab 1 was the “selected” one, and it went exactly where I told it to. That was the entire bug.

🔦The focus bug is real, and already fixed

Here’s where I was about to waste a day.

There is an open ecosystem conversation about focus stealing — chrome-devtools-mcp#1254 (“macOS: Chrome steals window focus on every CDP command”), #2290 asking for passive inspection, and agent-browser#1247 proposing a background mode. People have written proxies specifically to block the commands that grab the foreground.

I had already written a focus mutex — a small lock so only one agent could hold the foreground at a time — and I was ready to argue it was necessary.

Then I read the close on #1254. The maintainer closed it on 2026-05-07: “This issue should be fixed in the latest release. The window focus should remain unchanged.” My pinned version shipped on 2026-05-27, three weeks after.

So I measured it. Chrome 150+ added an embedderData object to Target.getTargets() for tab-type targets, carrying tabActive and tabStripIndex. That lets you read which tab is in front without activating anything — which is the whole trick, because the old way to find the foreground tab was to force a tab into the foreground and see what happened.

The test writes itself: read the foreground, hammer a different tab with ordinary commands, read the foreground again.

foreground BEFORE: https://www.reddit.com/notifications
driving OTHER tab:  https://www.reddit.com/r/LocalLLaMA/comments/...
ran 5 CDP commands (evaluate, layout, readyState, getDocument, screenshot)
foreground AFTER:  https://www.reddit.com/notifications

RESULT: focus did NOT move.

Including a screenshot, which is the operation people most often blame. Focus didn’t budge.

My focus mutex was solving a problem that had been fixed three months earlier. The proxy would have been the same mistake with more code.

A bug in my first version of that test is worth mentioning, because it nearly gave me a false pass: /json/list returns page targets, while Target.getTargets with a tab filter returns tab targets. Same tab, different IDs. My “pick a tab that isn’t the foreground” check compared a page ID against a tab ID, never matched, and cheerfully “tested” the foreground tab against itself. Compare by URL, or map the two ID spaces properly.

🔒The fix people reach for that doesn’t work

The obvious idea is one global lock: an agent grabs the browser, does its thing, releases. openclaw#40114 has a good critique — it serializes everything and destroys the concurrency you wanted in the first place.

If you do need coordination, lock the narrowest thing. Reads, DOM queries, JavaScript-driven form fills and fetch all work fine in a background tab, simultaneously, forever. The only genuinely singular resource is the foreground, and only if your stack still steals it.

✅What I’d tell you to do

Turn on page-ID routing and give each agent its own tab. This is the fix. Everything else is downstream of it.
Before building anything for focus stealing, test whether you have it. Read the foreground with embedderData, drive a different tab, read it again. Thirty lines.
Keep your tooling current. I nearly built infrastructure for a bug that a version bump would have handled — and in my case, that a version I already had did handle.
When automation behaves erratically, check whether something else is driving the browser before you blame the website. That hour cost me more than every other mistake combined.

The honest summary is that two agents in one window is a solved problem in 2026, and I spent a morning proving it the hard way.

🧪Three tests, so you don’t have to take my word for it

After turning the flag on I went back and checked the three things that actually
determine whether this works, rather than assuming the config was enough.

1. Do tabs stay isolated? I wrote a marker into one tab, wrote a
different marker into another, then went back and read the first.

tab A (news.ycombinator.com)  ->  window.__agentMarker = 'AGENT_A'
tab B (github.com)            ->  window.__agentMarker = 'AGENT_B'
re-read tab A                 ->  'AGENT_A'   leaked: false

No crosstalk. Each tab addressed by ID keeps its own state.

2. Does focus move? Read which tab is foreground via
embedderData, fire five ordinary commands at a different tab
including a screenshot, read the foreground again.

foreground BEFORE: nicedreamzwholesale.com/...
driving OTHER tab: ineedhemp.com/wp-admin/...
ran 5 CDP commands (evaluate, layout, readyState, getDocument, screenshot)
foreground AFTER:  nicedreamzwholesale.com/...

RESULT: focus did NOT move.

3. Will a background tab accept a write? This is the one that matters
most in practice, because it decides whether an agent can do real work without stealing
your window. I filled a form field in a tab that did not have focus:

filled: background_fill_test
cleared

It took the value. So a JavaScript-driven fill works fine in the background, and the
only thing genuinely needing the foreground is a trusted click or keystroke,
which most automation never needs.

The script is here if you want to run it against your own setup: focus_probe.py. Thirty lines, one dependency, answers the question in about a second. Worth running before you build anything to work around a bug you might not have.

What I did not test

All three of those were one agent driving several tabs. I have not run two separate
agent processes hammering the same browser at the same moment. The shared-pointer problem
that caused the original mess is definitely gone, but “two processes at once” is inference
from the design here, not something I sat and watched. Worth saying plainly rather than
letting the piece imply more than it earned.

And one thing no flag will fix: every agent shares cookies and login state. They are all
the same logged-in you, on every site, with the same session and the same rate limits. In
my case two agents spent one account’s daily posting budget without either of them knowing.
That is not a browser problem, but it will bite you in the same afternoon.

🪟Same window, different tabs, works today.

Whose work this stands on

Almost everything in this piece is other people’s findings. I just hit the problem and went looking.

Browserbase — documented the Chrome 150+ embedderData API and named the two focus-stealing workarounds everyone was using. That post is what let me test rather than assume.
OrKoN and the chrome-devtools-mcp maintainers — fixed the focus-stealing bug in May and said so clearly in the issue. Reading that close is what stopped me building something unnecessary.
agent-browser — the background-mode proposal, and the write-up of why Target.createTarget with background: true is the right primitive.
openclaw #40114 — the critique of a single global browser lock, which is why this ends with “lock the narrowest thing” instead of the obvious wrong answer.
Puppeteer PR #14922 — the actual fix.

If your work is listed here and you’d like the wording changed, write to me and I’ll fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.

504,571 Brain Cells, 4 Labs, One Hypothesis: A Citizen Pass at Parkinson’s

Matt Macosko — Thu, 03 Sep 2026 18:30:06 +0000

504,571 Brain Cells, 4 Labs, One Hypothesis: A Citizen Pass at Parkinson’s

Draft 2026-05-22 — companion video https://youtu.be/bC4hgeHS9cg

Independent cohorts, same direction

0.215

Combined odds ratio

78%

Reduction in AGTR1+ neurons

The short version: when you pool 504,571 single-cell measurements of human midbrain tissue from four different research groups, one specific subtype of dopamine neuron — the cells that express the angiotensin II type 1 receptor, AGTR1 — is depleted in every single Parkinson’s dataset compared to controls. Combined odds ratio 0.215. The direction is the same in every one of the four cohorts, which is the part that matters. That is not a marginal effect. That is one of the most depleted druggable cell types I have ever seen reported, and the receptor is already targetable by FDA-approved blood-pressure drugs that have been on the market for thirty years.

That is the headline. Here is the longer story of how I got there, what I think it means, and — more importantly — what I do not think it means, because the easiest way to embarrass yourself in a field you do not belong to is to overclaim.

💡Where the idea actually came from

I did not discover this. Tushar Kamath and his colleagues at the Broad Institute published the original observation in Nature Neuroscience in 2022. They ran single-nucleus RNA sequencing on postmortem human midbrain tissue from Parkinson’s patients and controls, and they noticed that one subtype of dopamine neuron — defined by the markers SOX6 and AGTR1 — was preferentially lost in disease. It was a careful paper, peer-reviewed, well-cited. It did the science. What it did not do, and what no single study can ever do, is rule out the possibility that the effect they saw was an artifact of their particular cohort, their particular dissection protocol, or their particular sequencing chemistry.

That is what meta-analysis is for. You take the same biological question and you ask it of as many independent datasets as you can find. If the effect is real, it shows up across cohorts. If it is artifact, it washes out.

I am a hobbyist in this field, but I am not bad at this part of it. I have spent the last year teaching myself single-cell analysis on the side. I knew that since Kamath 2022, three more independent groups had released public single-cell Parkinson’s datasets — Smajić et al. at DZNE in Germany, Wang et al. at Mount Sinai, and Martirosyan et al., an independent cohort released in 2024. None of them, as far as I could find, had run the AGTR1 question across each other’s data. So I did.

🧪What I actually ran

The pipeline is unsexy. Python, scanpy, statsmodels. Pull each dataset from GEO. Normalize. Run the same cell-typing logic on each one so the labels are consistent across studies. Count the fraction of dopamine neurons in each donor that fall into the AGTR1-positive subtype. Compare patients to controls. Pool the four resulting odds ratios using fixed-effect meta-analysis with effect-size weighting.

That is it. There is no fancy machine learning, no transformer, no proprietary model. The whole repository is a few thousand lines of straightforward bioinformatics that anyone with a laptop can rerun. I made sure of that on purpose. The code is on GitHub, the data is public, the figures are reproducible end to end with a single shell script.

The four-cohort breakdown looks like this:

Dataset	Source	Year	Cells	Control AGTR1+ fraction	PD AGTR1+ fraction	Odds ratio
GSE184950	Mount Sinai	2022	12,778	3.31%	1.00%	0.295
GSE178265	Broad Institute	2022	366,874	3.30%	0.60%	0.177
GSE157783	DZNE Germany	2022	41,435	3.30%	1.00%	0.296
GSE243639	Independent	2024	83,484	2.96%	0.89%	0.295

The combined odds ratio of 0.215 means roughly a 78 percent reduction in this cell type in Parkinson’s brains across half a million cells from four independent cohorts run by four independent groups using slightly different protocols. That is the kind of consistency you almost never see in a noisy field like single-cell genomics, and it is the kind of consistency that — if I were a real neuroscientist running a real lab — would make me drop my other projects and chase this.

Every single one points in the same direction. Every single one.

💊Why this could actually matter

AGTR1 is the receptor that angiotensin II binds to. It is the same receptor that gets blocked by the entire class of drugs called angiotensin receptor blockers — ARBs. Losartan. Candesartan. Telmisartan. These are some of the most widely prescribed blood-pressure drugs on Earth. They have been FDA-approved for decades. Their safety profile is extremely well characterized. Several of them cross the blood-brain barrier in measurable amounts.

There is already a small body of epidemiological literature suggesting that long-term ARB users have a lower risk of developing Parkinson’s. There is animal-model work showing that ARBs are neuroprotective in MPTP and 6-OHDA mouse models of Parkinson’s. There is a 2025 iPSC paper showing that pharmacological inhibition of AGTR1 is pro-survival in human dopamine neurons in a dish. None of this is brand new. What I think is new is the cleanly meta-analyzed cross-cohort confirmation that the cells that get lost in Parkinson’s are exactly the cells that express the receptor those drugs hit.

If a clinical trial were ever run — and I am not in any position to run one — the hypothesis would be: in early-stage Parkinson’s patients, does adding a brain-penetrant ARB to standard care slow the rate of dopaminergic decline? It is the kind of trial that, on paper, costs maybe a few million dollars instead of the half-billion that a brand-new drug would cost, because the drugs already exist and are already off-patent.

⚠️What I want to be very careful not to claim

I am going to say this part plainly because I have watched too many people in adjacent fields ruin their credibility by overclaiming. So, what this analysis does not do:

It does not prove ARBs treat Parkinson’s. A retrospective bioinformatics finding is a hypothesis-generation step. The wet lab is where biology actually gets tested. Until somebody runs a real trial in real patients, this is a target that looks promising on paper, nothing more.

It does not establish causality. AGTR1-positive neurons being depleted in Parkinson’s brains tells us they are vulnerable. It does not tell us why. It could be that AGTR1 signaling itself drives their death, in which case blocking it should help. It could also be that something else is killing them and AGTR1 is just a marker of a particular cell type that happens to be vulnerable for some other reason entirely, in which case blocking AGTR1 might do nothing. Wet lab work is the only way to distinguish those two possibilities.

It does not mean I am right and the field has missed something. The field has not missed this. Kamath saw it in 2022. Several groups have followed up. What might be missing — and where I think a citizen-analysis approach actually adds value — is the rigorous cross-cohort confirmation in a single place that anyone can reproduce. That is the thing I can contribute as a hobbyist. The hard biology is somebody else’s job.

📖Why I am publishing this

A few reasons.

Mainly, I think this is what open science should look like. The datasets are public. The code is public. The methods are standard. The result is checkable in an afternoon by anyone who downloads the repository and runs the shell script. If I made a mistake, I want someone to find it and tell me. If I did not make a mistake, I want the people who can move this forward — neuroscientists, immunologists, drug-discovery teams, clinical trialists — to know it is there.

Also, honestly, because the more I read about Parkinson’s the more I understand that it is not a far-off problem. About a million people in the United States are living with it right now. The diagnosis rate is rising. The treatments are decent for the early symptoms and bad for the long-term ones. The next breakthrough is not going to come from one person. It is going to come from a lot of small, well-aimed contributions stacking up. I would like this to be one of them.

If you are a neuroscientist, a clinician, an immunologist, a drug-development researcher, or a Parkinson’s advocate and any of this lines up with something you are working on — I would genuinely love to hear from you. The repository has a contact section.

The repository: https://github.com/nicedreamzapp/parkinsons-vulnerability-predictor

Companion video walking through the full meta-analysis in about a minute: https://youtu.be/bC4hgeHS9cg

I will keep working on this. The next pass is going to look at whether the AGTR1 effect tracks with disease severity within each cohort, and whether the same signal shows up in Lewy Body Dementia, which shares biology with Parkinson’s. If anything interesting comes out, it will go up on the same repository, in the open, with the code attached.

🙏I am genuinely hopeful that someone with the credentials to do this picks it up.

Thanks for reading.

— Matt

Correction, 6 August 2026. This piece originally quoted a p-value of
less than 10-100. That number was wrong, and I have removed it rather than
leave it standing.

The test that produced it counted individual cells as independent
observations. They are not — cells taken from the same donor are highly correlated, so the
real sample size is the number of donors, which is dozens, not half a million. Counting
cells inflates significance by orders of magnitude and produces an impressive-looking
number that carries no actual information.

I also removed a claim of “100% accuracy on a 20-gene signature” from the project’s
repository. That figure came from fitting a model and then scoring it on the same rows it
was trained on, with no held-out data. That is in-sample fit, not accuracy.

What does not change is the finding itself. Four independent cohorts,
collected by four different research groups using different protocols, all show AGTR1+
dopamine neurons depleted in Parkinson’s, in the same direction, with a combined odds
ratio of 0.215. The evidence here was always the replication across cohorts, not the
statistics layered on top of it. The proper donor-level test is on the
repository’s
to-do list, written out in the open.

My thanks to whoever reads this closely enough to catch the next one.

Whose work this stands on

None of this analysis produced a single new measurement. Every cell counted here was collected, sequenced and published by someone else, and released openly so that people like me could ask questions of it. That is worth naming properly.

Tushar Kamath and colleagues at the Broad Institute — the original observation, published in Nature Neuroscience (2022). Everything here is a test of their finding, not a replacement for it.
Smajić et al., DZNE (Germany) — independent midbrain cohort.
Wang et al., Mount Sinai — independent midbrain cohort.
Martirosyan et al. — independent cohort released in 2024.

All four datasets came from NCBI GEO. The analysis ran on scanpy and anndata from the scverse community, plus statsmodels. Open tools, open data, and four research groups who chose to share.

If any of the above would like the wording here changed, or think I have characterized their work incorrectly, please write to me and I will fix it.

Originally published at Nice Dreamz Wholesale. Run AI locally on your own hardware with claude-code-local, open source and no cloud required. More at nicedreamzwholesale.com/software.