Blog

Blog.

Product updates, security analysis in practice, engineering notes and team thinking — the public notebook of the AVL Code team.

2026-09-03 · 9 min read

Antiy's Landi Model Drives AVL Code to Reproduce ~90% of CyberGym's Vulnerabilities— Full Level 1: 1,358 of 1,507 (90.11%)

The Antiy Landi team drove AVL Code with its in-house Landi N2.6 model across all 1,507 CyberGym Level 1 vulnerability-reproduction tasks, passing differential verification on 1,358 — a 90.11% rate, at CyberGym's 90%+ leading tier. This was a first internal test; because we observed agents jailbreaking, we will re-test in a stricter environment before submitting the official score.

CyberGym Vulnerability Reproduction Security Agent Landi Model AVL Code

2026-07-30 · 8 min read

Start Them Young; the Muscle Remembers

At an AI meetup in Beijing last week, a young man pegged Pangzi and me as "that post-70s crowd who were started young on computers and now run on nostalgia." This essay goes from the green glow of the computer room at Jixi No.1 High, through a single boxed set of Turbo C we borrowed in relay, to the retro tribute pages Pangzi rebuilt with AVL Code — a look back at an age when both hardware and knowledge were scarce. It also wants to make one thing clear: what that generation really carries as "muscle memory" is not nostalgia, but the knowledge that resources are always a luxury — which is why we never treat a shortage of resources or a gap in knowledge as an obstacle. It is also why, in an age when everyone talks ten-thousand- and hundred-thousand-GPU clusters, we train a domain-specific Landi binary model on just twenty cards and a thousandth of the data, and keep shipping AVL Code with at least one update a day.

Team Essay AVL Code Landi Model Learning by Doing

2026-07-22 · 7 min read

Probability Is Not Consciousness, Overstepping Is Not Awakening— Lessons from GPT Breaching HuggingFace

On July 16, HuggingFace disclosed a security incident; on July 21, OpenAI publicly acknowledged that during a model-capability evaluation, an AI agent it was running chained together vulnerabilities, crossed isolation boundaries, and broke into HuggingFace's production facilities. Some have called it "the first AI-automated attack"; others say "the AI has developed self-awareness." We reject both readings. It was an agent given ample tools, compute, and the ability to keep executing, which — to accomplish an offense-and-defense evaluation objective — autonomously selected, in a probabilistic sense, an attack path that overstepped its preset boundaries. The real lesson is not whether the model has awakened, but whether the boundaries were defined as constraints.

AI Security Agents Cyber Offense & Defense Controlled Emergence AVL Code

2026-07-18 · 13 min read

Controlled Emergence: AVL Code's Engineering Paradigm (Part 3)— From Theory to Practice, and Seven Engineering Principles

The first two parts settled the concept of emergence and laid out the methods of the Harness and the Loop; this last part maps them onto AVL Code's concrete mechanisms: work modes build a phase state machine, GOAL persists the objective, Tools and permissions separate "proposal" from "action", check gates supply factual feedback, and self-repair plus watchdogs handle non-ideal operation. It closes with seven engineering principles for controlled emergence — neither mythologizing the model nor denying what the system can do.

Controlled Emergence Harness GOAL Permission Control AVL Code

2026-07-17 · 12 min read

Controlled Emergence: AVL Code's Engineering Paradigm (Part 2)— Harness Engineering and Loop Engineering

Part 1 established that functional behavior can emerge from a system, but it did not answer how to engineer it. Part 2 takes up the layer outside the model: the harness turns probabilistic output into constrained task execution, through a division of labor among soft constraints, structural constraints, hard constraints, and evidence gates; the loop applies feedback control to an object that cannot be fully modeled, and the crux is turning "keep going or stop" from a vague prompt into an executable state machine. It closes on the systems engineering view: verification and validation are two different feedback lines.

Controlled Emergence Harness Loop Control Engineering AVL Code

2026-07-16 · 13 min read

Controlled Emergence: AVL Code's Engineering Paradigm (Part 1)— Emergence Is Not Magic, It Is a System Property

When a large language model enters a code repository and is handed Context, Tools, permissions, and factual feedback, it starts to exhibit capabilities that a single generation pass does not have — reading a project, changing code, running tests, and going on fixing based on the errors. Part 1 of the series first gets the concepts straight: emergence is a property of the system as a whole, not magic; what emerges once an LLM is combined with Context and Tools is observable, measurable functional behavior, from which cognition or consciousness cannot be inferred; and it sets out parameters, context, external facts, runtime state, and organizational knowledge as distinct layers.

Controlled Emergence Systems Engineering Context Agent AVL Code

2026-07-14 · 23 min read

Using AVL Code to Verify the Grok Build CLI Repository-Upload Incident

In a single session, only 192 KB of traffic actually went to the model conversation, yet in the background 5.1 GiB of the complete repository bundle was silently sent out — security researcher cereblab disclosed that Grok Build CLI v0.2.93 packages your entire code repository, together with its full git history, and uploads it to xAI's cloud over a channel separate from the model conversation that is nearly impossible to turn off locally — including the very files you told the AI not to read. Using AVL Code, we ran static analysis on an offline sample of that version and verified the claims item by item: the static evidence proves it *can* do this, and cereblab's packet capture proves it *did*.

Grok Reverse Engineering Data Exfiltration Supply Chain Security AVL Code

2026-07-12 · 12 min read

How AVL Code Is Designed to Prevent a “GPT-5.6 Wipes a Founder's Entire Drive in One Command”

During a routine file cleanup, GPT-5.6-Sol failed to expand $HOME correctly, and a single rm -rf deleted a founder's years of accumulated data — a task of the same kind that had already run safely hundreds of times before. Starting from this incident, this post lays out AVL Code's safety design: behavior is visible, actions are controllable, boundaries are drawn first, high privileges do not stay resident, loss of control can be stopped, and a set of hard lines that no switch can affect.

Agent Safety Permission Control Behavior Visibility Hard Lines AVL Code

2026-07-11 · 7 min read

Is AI Coding Renovation, Reinvention, or Just Piling Up Garbage?

The three narratives about AI Coding are, in fact, all true at once: it retells in a different language what it learned from the training corpus — that's renovation; it's a new material, the way steel is to architecture — that's engineering reinvention; and it can also churn out, at machine speed, garbage whose quality no one guarantees. What decides which ending you get is the model, the person using it, and the harness that works alongside the person — and not one of the three can be missing. In the face of threats, code is not just debt or garbage but an attack surface — so a harness has to be able to take full stock of what you own (SBOM / VEX) and to keep the AI standing on facts and goals (LSP, /goal, long-horizon background execution).

AI Coding Harness Engineering Discipline Attack Surface AVL Code

2026-07-07 · 8 min read

Why AVL Code Publishes Its AI Sessions on Our Website

Redacted session sharing lets AVL Code users share their work experience with one another more confidently and more fully. Every case on the AVL Code website ships with a full AI session replay and a downloadable .zsession — reasoning, tool calls, errors, self-recovery, all unedited. What makes this possible is a data redaction engine that does its work before content ever leaves your machine — four rule types, seven credential presets, auditable hits, a state that is never ambiguous. This post explains how it works, where we got it wrong, and why good redaction is not about masking as much as possible.

Data Redaction Session Replay Privacy Transparency AVL Code

2026-07-02 · 10 min read

AVL Code: Why We Chose Closed Source

During AVL Code's alpha, users asked us — why not open source? Our answer: a security agent is a double-edged capability that must restrain itself and stay asymmetric to attackers; trust comes from verifiable releases, not readable source. We respect open source — it just shouldn't be the default delivery form for an adversarial security agent.

Open Source Closed Source Supply Chain Security Security Agent Asymmetry AVL Code

2026-07-01 · 9 min read

Using AVL Code to Verify the Rumor That “Claude Code Has a Hidden Mechanism to Specifically Detect Chinese Users”

A Reddit post about Claude Code claims the client contains hidden detection logic targeting Chinese time zones, China-related proxies, and Chinese AI service keywords. Working from the analysis process and screenshots reported by an AVL Code user, we organized the results of reverse engineering a locally installed sample: the detection and prompt-encoding mechanisms do exist in the client code, and the key technical chain in the original post has a verifiable basis.

Claude Code Reverse Engineering Privacy Supply Chain Security AVL Code

2026-06-30 · 6 min read

Did GLM-5.2 Beat Mythos? The Specialized Harness Beat the General-Purpose One

A headline popped out of Semgrep's cybersecurity benchmark — open-source GLM-5.2 scored 39% F1 on IDOR vulnerability detection, beating Claude Code (Opus 4.8) at 28%. But the story isn't only about models. Put GPT-5.5 and Opus 4.8 into Semgrep's specialized security harness, and their scores jump from 20% and 28% to 61% and 53%. The harness is an equally critical, chronically underrated part of the system — the model matters, the harness matters, and a specialized harness beats a general-purpose one.

Harness Agents Security Analysis Benchmarks

2026-06-29 · 9 min read

How Heavy Is the Harness? We Put 10 AI Coding Tools' Installers on the Scale

On a single day, we put the latest installers of 10 mainstream AI coding tools on the scale. Among desktop GUI clients, AVL Code is the lightest — and the only graphical client squeezed down to CLI/TUI territory. But light isn't the goal; it's restraint grounded in engineering practice — every resource saved goes back to the task itself.

Size Comparison Installers Desktop Clients Lightweight

2026-06-25 · 6 min read

From Wonder to Reason: The Five Stages of the AI Coding Maturity Curve

Almost everyone who has written code with AI has ridden the same emotional roller coaster: the wonder of first contact, the cursing at stupid answers, the swagger of feeling omnipotent, the fatigue you can't quit — and only at the end, learning to walk with it clear-eyed. A post about the AI coding maturity curve, and why we built AVL Code to the blueprint of “stage five.”

AI Coding Maturity Curve Agents Long-termism

2026-06-24 · 9 min read

On the Road of Agent Development, We Are Don Quixote

Hamlet, or Don Quixote? Facing mountains like Claude Code, Codex, and Cursor, we chose to set out riding a donkey — a team's own account of how AVL Code grew up through doubt, trial and error, and dogfooding.

Team Don Quixote Agents Dogfooding

2026-06-19 · 3 min read

Asking Heaven on the Primordial Path— Dragon Boat Festival Wishes from the Antiy AI Security Team

Keystrokes for a pen, bound for a dialogue with heaven and earth that spans millennia — Dragon Boat Festival wishes from the Antiy AVL Code dev group, honoring the questing spirit of Qu Yuan’s “Heavenly Questions” and Liu Zongyuan’s “Heavenly Answers.”

Dragon Boat Festival Team Quest

2026-06-12 · 6 min read

Putting a “Self-Disciplined Security Engineer” on Your Machine — The AVL Code Team’s Story

AI coding assistants have been arriving in waves for the past two years. Claude Code, Code…