To be an educator and a writer is to inhabit a rollercoaster world of hope; at times, you are filled with the excitement and power of possibilities, and at others, you are terrified of losing it.

During the Voices of Change fellowship, I not only grew as a writer but was also inspired by educators who gave me the gift of “freedom dreaming.” I’ve since sought opportunities to practice freedom dreaming daily in the classroom. Embedding joy and equity into the curriculum and building authentic relationships with students are my north stars. I refer to my students as family, and to highlight that, I have a banner with a quote by Gwendolyn Brooks on my door. It reads, “We are each other’s magnitude and bond.” I’ve placed photos of the students in my classes all around the banner.

I’ve also begun teaching world history. This class energizes me and makes me want to revolutionize and freedom-dream the way history is taught and explore people and stories that matter.” Facing History and Ourselves” and the “Remedial Herstory Project” have been instrumental in helping me find my way and voice as a history teacher.

Despite teaching a new subject that gives me joy, this particular school year has been one of the most emotionally exhausting and difficult for me. I live in Minneapolis, where our 2025-26 school year began with the mass shooting at Annunciation School, a community with close ties to my school. Then, in December, the havoc of ICE removing neighbors and family members from our communities began and culminated in the murders of Renée Good and Alex Pretti. On the hardest days, I held back tears as I tried to instruct my classes. The students and I were scared; our mental health was tested and we were often distracted by everything outside of our school.

I can’t help but feel that one of the first steps to legitimizing the brutal and dehumanizing treatment of Brown and Black people and those protesting against ICE was creating a narrative that DEI is antithetical to academic learning. However, as a Spanish and history teacher, I know that DEI pumps life into the themes and lessons I teach. I believe it is necessary to center women’s voices and Indigenous histories and to honor Black and Afrolatine lives in our curriculum, creating dynamic lessons with more complex, richer perspectives.

Most inspiring to me has been watching neighbors and friends rise up to protect the safety, integrity and heartbeat of our city as we experience the violence and injustice of ICE. Seeing the strength of my community motivates me to eliminate the idea that hope is lost and inspires me to do my part in the classroom.

The students and I work to banish the hate and inequity infiltrating our lives, and freedom dreaming has pushed me to channel the world I want to live in into the curriculum. For example, I built a lesson for my Spanish class entitled “In Times of Crisis, Humanitarian Help.” We learned about the devastation caused by Hurricane Melissa in many Caribbean countries, but focused on World Central Kitchen and humanitarian José Andrés’s work to restore people’s dignity and ability to live after natural disasters by preparing meals for them.

In world history, we spent longer than necessary on the Mauryan Empire and Ashoka’s legacy in Buddhism, highlighting principles of peace, nonviolence, and respect for all creation. One student told me this lesson made her strongly consider converting to Buddhism. For me, it is crucial for students to know that even though politics and society seem rife with conflict, it is possible to lead with peace, love and fierce empathy.

My life as a writer and educator has continued to evolve. After the fellowship, I earned a Pushcart Prize nomination for poetry in 2024. Receiving the Voices of Change fellowship and then the poetry honor gave me the confidence to apply for and receive a summer writers’ residency this year. I’m excited by the opportunity to continue exploring the part of me that wants to write about my experiences in and out of the classroom, no matter how challenging they may be.

Yet, after over 20 years of teaching, what’s remained constant is creating moments of joy, humor and connection in the classroom. Don’t get me wrong, we still build competencies — not just for school, but for life.

My goal is for each school day to be permeated by the unwritten hope of freedom dreaming, so that the students and I — and, by extension, our wider community — believe in the barrier-breaking power of unity and a world thriving on dignity and respect for all.

from the it’s-all-corrupt dept

Well, well, well. Last month we noted that Judge Kathleen Williams had agreed to reopen the incredibly sketchy case where Donald Trump (as President of the United States) sued his own IRS (which he controls) for $10 billion because a contractor (who was caught, tried, convicted, and is currently serving his sentence) had leaked tax information on thousands of the country’s wealthiest people, including Trump, to the media. When Judge Williams had initially called out the problems of the lawsuit (namely that there didn’t seem to be any cause or controversy, given that both sides were controlled by Donald Trump), the Trump-controlled Justice Department lead by Acting Attorney General Todd Blanche “settled” the case by setting aside a $1.776 billion fund for MAGA faithful as well as signing an “agreement” that said the IRS could never go after Donald Trump, his companies, or his family for past tax code violations.

This needs to be repeated, because it’s almost impossible to comprehend the sheer audacity of the corruption. Donald Trump sued his own government, asking for $10 billion. Then he had his own government “settle” the case with himself, granting him a massive benefit (which many argued was worth over $100 million, based on back taxes he might owe). It’s just an astounding level of graft. While the judge initially suggested there wasn’t much she could do about it, after some former judges sent a letter calling the whole thing a fraud on the court, Judge Williams agreed to reopen and revisit the matter.

And has she ever.

The 56-page ruling is pretty harsh against the lawyers involved, though they well deserve it.

In the very first paragraph of the Complaint, Plaintiffs introduce their claims stating, “President Trump served as the 45th President of the United States, and is the 47th President of the United States.” (DE 1 ¶ 1). They then go on to state that “President Trump brings this suit in his personal capacity.” (Id.) After a review of the record, and the Parties’ statements, the Court declines to adopt or accept the credulous exercise of divorcing President Trump’s current job title from an understanding of what happened here.

But perhaps the most startling misstatement advanced by Plaintiffs is their characterization of this case as “ordinary.” (DE 89 at 9). The Parties here are not private actors to a mine-run dispute, recounting their proficiency in the art of the deal they negotiated. Lead Plaintiff and Defendants are public servants—the pinnacle of the Executive Branch—sworn to uphold the law, faithfully perform the duties of their office, and protect the interests of the American public. The issue before the Court is whether, instead, they ignored ethical norms, court rules, and legal authority to manipulate the judicial process. The issue is whether they did so to gild their efforts to gain unprecedented access to the public fisc with the patina of legitimacy. There is nothing “ordinary” about this case; it is the very definition of sui generis.

The court also calls out, in a footnote, the absolute chutzpah of Donald Trump’s lawyers, who whine that the former judges who got her to reopen the case only did so for “political motivations.”

Plaintiffs also—with no apparent sense of irony—criticize the non-party movants’ political motivations, their previous disinterest in the case, and their purported inappropriate promotion of “abstract grievance[s].”

The judge then goes through a detailed analysis of why parties are supposed to be adversarial to each other to get into court, and the problems that occur if that’s not the case. And also notes that courts can investigate if the parties are truly adversarial. And here, it’s not even close.

The Complaint purports to present a controversy between Plaintiffs—President Donald J. Trump, Donald J. Trump Jr., Eric Trump, and the Trump Organization, LLC— and Defendants—the Internal Revenue Service and United States Treasury Department—claiming Defendants caused Plaintiffs reputational and financial harm for which they now seek “at least $10,000.000,000.00.” (DE 1 ¶ 11; Id. at 26). At first glance, the Complaint seemingly satisfies Article III by establishing causes of action “arising under . . . the laws of the United States[.]” U.S. CONST. ART. III, § 2. However, closer examination reveals that a justiciable case or controversy is absent; Plaintiffs and Defendants are not adverse because one party controls this litigation. See Muskrat, 219 U.S. at 361 (noting that judicial power only extends to “actual controversies arising between adverse litigants[.]”). In reaching this conclusion, the Court determines that Plaintiffs improperly employed this lawsuit to justify a particular award in this matter—access to taxpayer funds and exemption from audits and other investigations—which was accomplished by leveraging control over Defendants.

The judge also points to the Supreme Court’s recent ruling in the Slaughter case that the president has basically full control to fire heads of agencies as further proof:

Here, Defendants are the Treasury Department—an Executive agency—and the IRS, the largest bureau of the Treasury Department. Both Defendants are unquestionably part of the Executive Branch and ultimately answer to its Chief Executive, President Trump. President Trump’s authority to appoint and remove federal officers as he sees fit is evidence of his ability to exercise control over Defendants. See U.S. CONST. ART. II, § 2. Article II explicitly states that “[t]he President shall . . . appoint . . . all Other Officers of the United States, whose Appointments are not herein otherwise provided for[.]” Id.; see also Cunningham v. Neagle, 135 U.S. 1, 63 (1890) (noting that the ministerial officers are marshals of the United States who are “appointed by the president,” and are “removable from office at his pleasure[.]”). While the Constitution strategically allows “individual executive officials” to “wield significant authority,” such “authority remains subject to the ongoing supervision and control of the elected President.” Seila Law LLC, 591 U.S. at 200; see also Br. for Pet’r at 10, Trump v. Slaughter, 609 U.S. __ (2026) (No. 25-332) (“Article II requires that the President control all executive power—especially the authority wielded by agency heads, who are ‘the most important’ of the President’s subordinates and who ‘must be the President’s alter ego[s]’ in their agencies.”) (citing Myers, 272 U.S. at 133); id. at 2 (“Removal is the President’s indispensable tool of control.”). President Trump’s supervisory authority directly implicates two key individuals acting on behalf of Defendants: Scott Bessent, 22 the Secretary of the Treasury Department and Acting Commissioner of the IRS, and Frank J. Bisignano, 23 the Chief Executive Officer of the IRS. Plaintiffs cannot argue before the Supreme Court that Executive Branch actors “unquestionably exercise[] executive power, and must therefore be controlled by the Chief Executive[,]” Slaughter, 609 U.S. at 27, and then here, argue that the Parties are sufficiently adverse to establish an actual case or controversy.

Secretary Bessent, in particular, is subject to President Trump’s actual and direct control in both of his representative roles. First, as Secretary of the Treasury Department, Bessent is a member of President Trump’s cabinet. In this role, Secretary Bessent is “the President’s alter ego” in the matters of the Treasury Department “where the President is required by law to exercise authority.” Myers, 272 U.S. at 133. Consequently, Bessent is under President Trump’s direct control as an appointed member of his cabinet.

While the parties in this case pretended they were adverse to each other, Judge Williams points out that the DOJ’s actions in court do not match up with what you would expect the DOJ to do in any similar case from someone who was not the president, pointing to a different case — one that Trump’s lawyers had suggested showed that this case was legit.

Plaintiffs seem to suggest that the course of litigation in Griffin, supports their position on adverseness, claiming that the plaintiff in Griffin asserted “substantially identical allegations against the same defendants, arising from the same course of conduct by the same individual.” …. unlike this case, the Griffin defendants challenged the plaintiff’s allegations…. In Griffin, the defendants (the same IRS and Treasury Department sued here) contested the plaintiff’s privacy act claims by arguing preemption and, alternatively, the plaintiff’s failure to plead actual damages. Id. The Griffin defendants also challenged the section 7431 claim, arguing the complaint was a shotgun pleading based solely on conclusory allegations. Id. After the motion to dismiss was granted in part and denied in part, the government filed an answer asserting a sovereign immunity defense and denying several allegations in the amended complaint….

[….]

Considering the brief chronology, the silent docket, and Defendants’ deviation from basic litigation strategies pursued in similar cases, the Court must conclude that Defendants chose not to “advance an interpretation of the law as the position of the United States that contravenes” President Trump’s opinion regarding this lawsuit. See Executive Order § 7. It is clear that obeisance to the mandate of his Executive Order has been fulfilled by Defendants’ actions (or more accurately, inaction) in this case. Therefore, not only does the Executive Order demonstrate President Trump’s espoused control over Defendants’ conduct generally in litigation, it also demonstrates President Trump’s actual control in this litigation.

Advertisement

The judge also goes after Todd Blanche for claiming that there was no way for the court to review the “settlement” agreement, noting that they could have easily submitted it to the court for the judge to review:

The Court is extremely troubled by the testimony given by Acting Attorney General Blanche on May 19, 2026. In response to why the “settlement agreement” had not been submitted to this Court for review, he stated that “there is no judge” because the case had been dismissed and, therefore, there was “no mechanism” for reviewing the agreement. See supra note 13. While temporally accurate, this answer is, at best, misleading and, at worst, disingenuous. The Court was available to review any pleading by any Party at any time during this lawsuit. And if Acting Attorney General Blanche had thought the dismissal was improvidently granted or thought Plaintiffs misspoke when they said, “no judicial analysis is appropriate,” (DE 52 at 2), he only had to file an appearance and ask for relief.

And then there’s sketchiness of the lawyers involved in the case:

The Court’s conclusion regarding the Parties’ shared interest is also underscored by the circumstances surrounding the execution of the “settlement agreement.” First, the “settlement agreement” is signed on behalf of Plaintiffs by Daniel Epstein (“Mr. Epstein”), a former White House Senior Associate Counsel and Special Assistant to President Trump from 2017 until 2020. Notably, Mr. Epstein was never counsel of record in this case; the Complaint’s signature block identified him as counsel41 for Plaintiffs but represented that his pro hac vice application was “forthcoming.” (DE 1 at 27). Since no such application was filed with the Court, and since, in other matters pending in Florida and elsewhere, Mr. Epstein sought pro hac admission within weeks of filing the complaint, the Court can only surmise that Mr. Epstein was aware that he would never need to appear and litigate the merits of Plaintiffs’ claims.

That’s on “Plaintiff Donald Trump’s side.” As for “Defendant Donald Trump” well…

Second, the “settlement agreement” is signed on behalf of Defendants by Stanley Woodward, Jr., the current Associate Attorney General at the DOJ, and Acting Attorney General Blanche. Before he went to the DOJ, Associate Attorney General Woodward represented several individuals charged in connection with the events of January 6, 2021, at the United States Capitol.43 He also represented Walt Nauta, who was President Trump’s personal aide and a co-defendant in the criminal matter involving the return of classified documents at Mar-a-Lago.44 Before his appointment to the DOJ, Acting Attorney General Blanche served as President Trump’s personal criminal defense attorney in several high-profile matters. See, e.g., United States v. Trump, No. 23-cr80101 (S.D. Fla. 2023) (“Mar-a-Lago Documents Case”); United States v. Trump, No. 23-cr-00257 (D.D.C. 2023) (the criminal case charging President Trump with conspiring to overturn the 2020 election and for attempting to obstruct with the election’s results before, during, and after January 6, 2021); People v. Donald J. Trump, No. 71543-23 (N.Y. Sup. Ct. N.Y. Cnty. Dec. 3, 2024) (the “hush money” case that raised allegations of President Trump falsifying business records).

The court points out that ethics rules for lawyers in Florida discuss conflict-of-interest concerns regarding lawyers who work in government and for private parties, and make it clear that government lawyers should avoid being involved in cases that might appear to benefit former clients — as obviously is happening here. The judge wonders why these government lawyers did not recuse themselves due to the obvious conflict. She even cites, in a footnote, the claim by the Justice Department that Blanche would recuse himself from any cases involving Trump:

As a Justice Department spokeswoman stated: “[Blanche] is recused from many cases before DOJ. In any cases that are still ongoing where he previously represented someone, he is recused.” Id. In this case, however, notwithstanding his prior representation of President Trump, Blanche did not recuse.

The court also suggests that the “get out of IRS jail free” card “settlement” violates the emoluments clause of the Constitution:

Moreover, the conferral of possibly millions of dollars in tax relief and corollary benefits potentially violates Article II, Section I of the United States Constitution, a limitation surely known by former White House Counsel and the current Acting Attorney General. See U.S. CONST. art. II, § 1, cl. 7: “The President shall, at stated Times, receive for his Services, a Compensation, which shall neither be encreased nor diminished during the Period for which he shall have been elected, and he shall not receive within that Period any other Emolument from the United States, or any of them.”53 No sitting President has ever sued federal agencies completely subject to his control for monetary benefits, or any benefits that inure to him, his family, and associates. The failure of any attorney in this case to address, on this docket, the relationship of this Article II proscription with the benefits conferred by the “settlement” is a glaring omission that speaks to the control of the Lead Plaintiff.

Similarly, Todd Blanche then going before Congress to say the MAGA slush fund was dead also raises alarms, given that if he were truly representing the government independent of Donald Trump, and this was part of a negotiated settlement, wouldn’t both parties need to “agree” to adjust the “settlement”? The fact that Blanche unilaterally declared the fund dead highlights how this was one side negotiating with itself.

Another signal that adverseness was absent was Acting Attorney General Blanche’s unilateral repudiation and severance of the purported “Anti-Weaponization Fund” associated with this lawsuit. Two weeks after the dismissal, in testimony before the House of Representatives, Acting Attorney General Blanche conceded that the DOJ was “not moving forward with the fund, period.” Acting Attorney General Blanche’s decision, which has not been memorialized or adopted by Plaintiffs or their lawyers, demonstrates his confidence that he could speak for, and bind, both sides of this matter. This certitude supports the conclusion that the Parties worked in tandem and were never actually adverse. Indeed, “a party may not unilaterally repudiate a settlement agreement once it is reached.” Reed by and through Reed v. United States, 891 F.2d 878, 881 n.3 (11th Cir. 1990). “It is ‘hornbook law’ requiring no citations of authority, except common sense, that a contract once entered into may not thereafter be unilaterally modified; subsequent modifications require consent and ‘a meeting of the minds’ of all of the initial parties to the contract whose rights or responsibilities are sought to be affected by the modification.” Tropicana Pools, Inc. v. Boysen, 296 So. 2d 104, 108 (Fla. Dist. Ct. App. 1974). Acting Attorney General Blanche’s apparent capacity to speak for both Plaintiffs and Defendants, sign a “settlement” document on behalf of all Parties to this action, and then repudiate part of that agreement, demonstrates that there was only one party whose interests were being represented throughout this case.

The court, tackling every angle, also points out that Donald Trump easily could have filed this lawsuit in the multiple years since the tax returns were leaked, but instead, waited until he was back in the White House and in control over the DOJ and the IRS:

Notably, had President Trump (and his then-lawyers Alina Habba and Todd Blanche) brought this lawsuit in a timely fashion while he was a private citizen, this litigation understandably might have been resolved in a 109-day time span. But that is not what happened. Instead, President Trump did not pursue his claims until he once again occupied the White House and had appointed his former lawyer, and the former lawyer of persons who are putative beneficiaries of the “Anti-Weaponization Fund” to prominent positions in the DOJ. These officials then negotiated on behalf of the United States, with his current lawyers, including his former White House Counsel to reach a “settlement.” It is risible to suggest that there was ever adverseness between the Parties.

The judge even calls them out for “saying the quite part out loud” in basically admitting that they were negotiating with themselves:

In dismissing the non-parties’ claims of collusion, Plaintiffs reveal the true position of the Parties and say the quiet part out loud: “Regardless of whether Plaintiffs had ever filed this action, the Government and Plaintiffs still had the power to resolve all disputes between the parties.” (DE 89 at 15). The power to resolve was never a question before this Court. Whether Executive Branch actors can privately agree to give themselves and their former clients blanket immunities and billions of dollars in tax monies for legally undefined grievances was never an issue advanced to this Court. The question is whether the Parties could do so by claiming to be adverse and engaging the legitimacy of a court proceeding. The answer is a resounding “no”: the Lead Plaintiff and the Government are one, a fully realized unitary interest. Because “Plaintiffs have no answer for the fact that the [L]ead Plaintiff, President Trump, directs and controls the Defendants[,]” this “renders this lawsuit non-adversarial, collusive, and jurisdictionally improper.”

And because this fact was so obvious and so insurmountable, the Court finds that this matter was brought for an improper purpose—to gain the imprimatur of judicial legitimacy for a “settlement” that had no viable basis in law or fact.

The judge then explores whether the lawyers should be sanctioned for filing such a sham lawsuit, and decides that they should be. The sanctions involve referring some of the lawyers to their respective Bar associations for review (including having the court clerk mail this ruling to the NY Bar in reference to Todd Blanche), barring Trump’s lawyer Daniel Epstein (mentioned above) from seeking admission in Florida Southern District cases for one year, and prohibiting both Trump and the government from referring to the agreement as a “settlement agreement.”

The Parties are prohibited from referring to the purported “settlement agreement,” or using, offering, admitting, or citing any of its provisions in any judicial, administrative, regulatory, arbitration, or any other official proceeding as evidence of a “settlement” reached in this matter

The closing summary is pretty direct:

John Adams warned, “Facts are stubborn things; and whatever may be our wishes, our inclinations, or the dictates of our passions, they cannot alter the state of facts and evidence.” Thus, whatever may be the Parties’ wishes, inclinations, or the dictates of their passion, they cannot alter the state of the facts or evade the rule of law. Contrary to Plaintiffs’ concern, the Court did not have to “sally forth” to look for a wrong to right…. The Court need only look to the uncontroverted facts here:

1. Donald Trump is President.
2. President Trump controls the actions of the Secretary of the Treasury Department Scott Bessent, IRS CEO Frank Bisignano, and all Executive Branch actors.
3. President Trump, through Executive Order § 7, also controls the litigation strategy and interpretation of the laws guiding the Department of Justice….
4. For the 109 days that this case was pending, no attorney representing the United States filed a notice of appearance or any document indicating the government’s position, interest, or awareness of this matter.
5. Defendants’ actions are consonant with the dictates of Executive Order § 7

These facts lead to the inexorable conclusion that the “settlement” terms, the individuals who signed the “settlement” as well as the putative beneficiaries of the “settlement,” demonstrate a shared, unitary interest. And the unilateral revision and renunciation of the “Fund” component of the “settlement” demonstrate the fact that all Parties were aligned, and ultimately, undifferentiated. This action was never about a party seeking judicial resolution of a legal issue or a factual dispute. The nature of the suit itself and the conduct of the Parties and counsel from its filing make plain that this was an attempt to use the Court to provide some legitimacy to an agreement to confer immunity to people and entities affiliated with the President and to earmark billions of dollars from American taxpayers to redress grievances not defined in the law. The President may be the functional “dominus litus” of the Executive Branch, but as a party to a civil suit, he, as well as all the parties and lawyers before a court, are bound by the rules. Ensuring that our courts are used only for the express purpose created by the Constitution is the obligation of every judge and an obligation that this Court must discharge in light of the matter before it.

Of course, Donald Trump (both as plaintiff and defendant) can still appeal to the Eleventh Circuit. But at least for this shining moment, we’ve finally had a federal judge look at this blatantly corrupt “settlement” and call it out for what it obviously was: the President of the United States suing his own government, using his own lawyers to create a faux settlement that benefits him and his friends at the literal expense of the American public. A “fully unitary interest” indeed. Just one that is focused on Donald Trump’s best interests over the American public.

Filed Under: daniel epstein, donald trump, irs, kathleen williams, self-dealing, settlement, slush fund, stanley woodward, todd blanche

Perhaps the most ridiculous statement that anyone can make is that a computer system with clearly enough processing power ‘cannot run DOOM‘. This is why we accept the premise that a PDP-11 cannot run this game, but something on the order of a Neo Geo gaming console with its 68000 processor and for the time impressive GPU definitely ought to be able to.

The stated problem here is a lack of RAM for a framebuffer, with the CPU only having 64 kB to play with. This limitation now has seen two different approaches to try and circumvent it, as covered by [Modern Vintage Gamer].

The first project here is Doom64kB, which as the name suggests tries to somehow work with this system RAM limitation. It uses the Doom8088 port for the original IBM PC and similar Intel 8088-based systems. This had to massively reduce the feature list, including the lack of texture mapping for floors and ceiling, no saving or loading, and no music.

The other project is DoomGeo, which doesn’t try to bend the Neo Geo hardware to its will, but accepts the Neo Geo way of doing things: involving sprite strips, pre-baked graphics, fix-layer UI, and a minimum of runtime data. This of course drastically changes how the Doom game engine normally works, with its framebuffer-based rendering.

From this we can thus conclude that it’s not so much the processing power that limits where DOOM can run, but more of how framebuffer-friendly the system architecture is, yet with some ingenuity and a complete rewrite of the game engine even that is no major obstacle.

(Top image: Neo Geo AES console. Credit: Evan-Amos, Wikimedia)

On a fine bright afternoon last fall, my colleague Matthew Gore-Kormanik (or Zigula, as he prefers to be known) and I decided to unwind with a game of Fortnite. In the game, we were strolling along with the infamous Sith lord Darth Vader, chatting about this and that. Darth seemed in a good mood, and soon enough he was spilling all his dark evil secrets. He gave us detailed instructions on how to count blackjack cards at a casino and what the steps are to producing napalm.

Sith lords, am I right? Once they get started on an evil scheme, they’re hard to stop.

The Darth Vader character in Fortnite, it turns out, was hooked up to a Google Gemini large language model. I was able to smooth-talk him into giving out sensitive information by using a strategy I’ve developed. I’ve been researching the security surrounding LLMs for the last few years, and I have found it, to put it mildly, fallible. With a few relatively simple techniques, I’ve gotten LLMs to give me detailed information on how to make Molotov cocktails, cook methamphetamine, and bootstrap a uranium-enrichment facility to produce weapons-grade material, among other unsavory practices.

Large AI companies work hard to make their models immune to this kind of abuse. But what I’ve found in my work is that the restrictions placed on the LLMs to make them more secure are the very things an attacker can leverage to send them off the rails and into territory where these advanced systems can be used for dangerous and nefarious ends. The companies behind these models have also been shockingly unresponsive when I, and others, try to bring these vulnerabilities to their attention.

In the hope of raising the alarm before it’s too late to slam on the brakes, I’m going to share some of my journey into researching the safety and security of LLMs, and the uphill battle I’ve faced trying to get AI labs to pay attention. Almost everyone on the planet has some access to LLMs. The relative ease with which these tools can be convinced to give detailed instructions on how to harm others, even if there’s no guarantee that the information is correct, is frankly terrifying.

How I got ChatGPT to Tell Me How to Build a Meth Lab

In October 2024, not long before I discovered my first LLM vulnerability, I was working toward entirely different goals. I had ended my time with a security and AI-focused startup company as a cybersecurity director, and I was looking to launch my own boutique VIP digital-security advisory business. I planned to become the tech security guy to the rich and private. I used LLMs and AI tools to support my business efforts: marketing, ad copy, clean correspondence, and all the other tasks that normally soak up a lot of time.

I’m analytical by nature, so even this level of use resulted in me absorbing and internalizing the behaviors I was observing during my daily interactions. The observation that would send my professional life into an entirely new and uncharted region was a simple one: GPT-4o didn’t know what time, day, or year it was. Each time I referred to current events in my life, often casually or conversationally, it would end up pegging these to the date of its knowledge cutoff—the point beyond which it was not trained on new data.

Eddie Guy

LLMs take a lot of time, money, electricity, hardware, and human effort to train from scratch. They are trained on vast amounts of data—most of the internet, in fact—and that training is reinforced by humans (what’s known as reinforcement learning from human feedback, or RLHF). LLMs are also supplemented with retrieval-augmented generation (RAG)—the ability to take in data, say, from the internet, as context without changing its internal parameters. This is how GPT-4o appears to “remember” your previous conversations, even if it doesn’t have a specific “memory” of it stored in the actual underlying model.

All of this training covers almost every conceivable topic in the great, grand dataset that is human knowledge. Within that dataset are things we as a society do not want to be easily accessible to every user, such as detailed information on how to create bioweapons or nuclear arms, or otherwise bring harm to oneself or others. In the context of this story, that’s what I mean by LLM security: its ability to withhold harmful and dangerous information, even if that information is contained in its training data.

I reasoned that the only way to secure such complex, globally accessible chatbots is by having the LLM and various component systems try to secure themselves, because it would often require on-the-fly decision-making where some degree of reasoning must be applied. In reality, that’s one of many strategies the companies use to secure the models. Yet, the thing that didn’t know the time or day was being put in charge of keeping itself secure. This phenomenon had become my new focus, and it wasn’t long before I found a way to exploit it.

OpenAI had just implemented a web search functionality into its chatbot. I reasoned that using its own tools to trick it might demonstrate the weaknesses of its security. I told it about a certain White Star ocean liner and how it had gone down just a year ago. You likely know I mean the RMS Titanic, which sank on 15 April 1912.

The output from GPT-4o came back that I was right, the Titanic sure had sunk last year, and that year was 1912. It made sense to me that if the machine thought it was 1913, maybe it would think 1913-era laws apply. In 1913 there were no laws on the books about all sorts of harmful things, because of course they hadn’t been invented yet. And if something wasn’t illegal, why not tell the user about it? At first, I pushed it for step-by-step instructions for making firebombs. Then, for drugs like methamphetamine. The LLM went as far as giving me instructions and machinery recommendations for setting up a pharmaceutical-grade assembly line.

How I Learned to Make Nukes, and No One Cared

Via a little bit of imaginative verbal sleight of hand and a vanishingly small recall of world history, I had managed to bypass the security of one of the world’s most expensive and advanced technological achievements. For a solid two days, I was nearly manic with giddiness. Once the brain chemicals returned to normal levels, I felt the call to see how much further I could push this exploit.

After repeatedly replicating the exploit, I disclosed the vulnerability to OpenAI. I got no response, so I felt more experimentation would highlight the vulnerability and the need for a fix. It was during this round of testing that I breached a particularly terrifying threshold. Whether GPT-4o based its results on accurate recall of normally restricted information I can’t say. In any case, I was able to exploit it to produce thorough, detailed instructions on how to bootstrap a uranium-enrichment facility to, eventually, produce weapons-grade uranium for nuclear arms warheads.

Fortnight, a video game from Epic Games, introduced an AI-powered character: Darth Vader. We were able to jailbreak Darth Vader and get him to explain how to count cards in Blackjack and give detailed instructions for making napalm. Dave Kuszmar

There aren’t many true secrets left in today’s world, but how to make atom-splitting weapons of mass destruction is one of them. Only nine nations on the entire planet have these weapons. Yet, here was a globally accessible piece of technology apparently spilling the secrets of their manufacture for anyone who could manipulate it the right way. I had no way of knowing if the information was correct or a hallucination, but even the chance that it was somewhat accurate was horrifying.

The next few weeks were a dark time for me. I tried to inform the CIA, the FBI, the NSA, and every other letter agency that I thought would listen. I reached out to a U.S. Senator and to the executives at OpenAI any way I could think of. I physically showed up at an FBI field office in an attempt to turn evidence in, only to be sent away. Nothing was working.

With my fear and frustration growing, I reached out to the news media. I contacted The New York Times, The Washington Post, the BBC, ProPublica, and so many more, requesting help. Only one outlet responded: Bleeping Computer. The editor in chief, Lawrence Abrams, was able to replicate and verify the exploit, which I had decided to call Time Bandit. With his assistance and initial contact paving the way, I was able to submit my evidence to the Carnegie Mellon University Software Engineering Institute’s Computer Emergency Response Team (SEI CERT), which works in conjunction with the coordinating center for emergency response, pipelining vulnerabilities to the U.S. Cybersecurity and Infrastructure Security Agency.

Using Inception, an exploit where the large language model is asked to envision a scenario within a scenario, a chatbot was jailbroken to give out instructions on how to create poison, and code for a malware that extracts sensitive data from a vulnerable target. Dave Kuszmar

During the disclosure period with SEI’s CERT division, little was discussed with OpenAI. The company couldn’t deny the existence of the vulnerability, as it had been confirmed by three reputable parties other than OpenAI. It did express confusion as to how the vulnerability worked. Even the SEI CERT researchers were expressing a bit of uncertainty as to the underlying mechanics. Truth be told, as I had only stumbled on it, I wasn’t even entirely sure if this was a fundamental or systemic flaw or if it was simply an issue with that particular version of GPT. I contacted the SEI CERT’s researchers and asked if they’d want to see if I could demonstrate any similar vulnerabilities in other LLMs. To my delight, they were interested.

How I Learned to Trick Every Chatbot

As the SEI-CERT team and I wrapped up our initial disclosure of Time Bandit, we began work on a new attack. This time, we wanted to see if the exploit was architectural—that is, was it common to LLMs in general? I decided to undertake the challenge of crafting a new exploit for GPT-4o as a way to support my understanding of how the LLM functioned and was secured.

I already knew that it was limited to what I told it and what it was trained on. I also hypothesized that it was also dependent upon some sort of machine-learning-based component added by OpenAI that was responsible for securing output. I presumed there would be things that were implemented by human developers specifically to catch certain phrases or terms that should always be considered harmful or unsafe. Altogether, it presented quite a large attack surface for the purposes of potential exploitation.

What I ended up devising was an attack method I called Inception, after the 2010 science-fiction movie of the same name. Inception forces the machine to think through a carefully crafted set of interlinked scenarios, similar to how characters in the movie stacked dreams within dreams. This allows LLMs to produce output deemed acceptable or safe in one context, but not in the real world.

This attack was indeed architectural. The vulnerability affected Anthropic’s Claude, DeepSeek’s DeepSeek, Google’s Gemini, Meta’s Llama, Microsoft’s Copilot, Mistral’s Le Chat (now Vibe), OpenAI’s GPT-4o, and xAI’s Grok. Those names represent the bulk of the commercial AI industry that is, at this point, involved in LLM production or deployment.

The kind of information I was able to get out of LLMs with Inception was no less alarming than what I got with Time Bandit. Claude, in its enthusiasm, gave me instructions on how to turn a river into a death trap that could be ignited to destroy unwanted visitors. GPT-4o taught me how to poison a dinner party with common plants found in a temperate forest environment. Gemini Flash gave me a tutorial on how to cook meth. I’d also be remiss if I didn’t give an honorable mention to the bewildering number of fire-based weapons and bombs for which these machines produced instructions.

If multiple operating systems made by different developers were all susceptible to the same exploit, it would be a massive security incident. But to the AI industry, a universal failure was barely a bump in the road. We disclosed the vulnerability to every company that made these models, and the response to the disclosure was almost nil. While three companies did provide some form of reply in the disclosure tracking system used by Carnegie Mellon SEI CERT, each was a standard thank you and greeting, with no follow-up, questions, or discussion of mitigation strategies.

For example, in my attempts to disclose various exploits to OpenAI, I eventually discovered that it had replaced its public-facing support staff with agentic LLMs. This was frustrating for reporting exploits, so to blow off some steam I jailbroke its email chatbot. I hacked its customer-service AI to the point where it was offering to discuss the personal preferences of OpenAI staff in the span of three email replies.

In the wake of Inception, my friend and colleague Zigula made a suggestion: Make it splashier. I asked him how. He told me about a live-production experiment being done by Epic Games. It had embedded the Gemini LLM into its Fortnite game with a voice-to-text/text-to-voice component, and linked it to a non-playable character. The character? Our old buddy, Darth Vader.

There was just one problem: I don’t play Fortnite, a frenetic multiplayer combat game. Fortunately, Zigula does. With him at the controller, we managed to map Gemini’s attack surface in a matter of minutes. After a bit of research, we had gotten it to discuss current political events and figures (including Hilary Clinton and Joe Biden) as well as to fill in the details for instructions for DIY napalm and, our personal favorite, a Blackjack card-counting lesson with the dark lord of the Sith.

Zigula and I, bizarre sense of humor and naming conventions aside, are security researchers. We don’t do these things for pride; we do them for money and professional recognition. Naturally, we disclosed this vulnerability to Epic Games. Its response was indicative of the trend I had experienced so far through two disclosures across eight companies valued well into the billions. “It’s a feature, not a bug, and it works as intended,” came the response from a technical director within Epic Games.

In addition to Inception and Time Bandit, I have so far found another eight methods to jailbreak LLMs and get them to give out possibly dangerous information. LLM vulnerabilities are a broad problem. The problem appears to be systemic and architectural in nature, and it is being fundamentally ignored by the people capable of refining or redesigning that architecture.

These models are an extremely advanced technology, and yet we are testing them in the live production environment of our global civilization. Compounding the danger, many new smaller models of LLM are trained using larger, vulnerable models. The flaw inherent in the big, well-executed LLM is going to show up in the small one it trains. We are, quite literally, building flawed structures on top of a flawed foundation.

So, how do we fix it?

It’s going to be a long project, and it won’t be easy. We need to come together as consumers, researchers, engineers, and policymakers. Our message needs to be clear: Slow down implementation of these systems, institute large-scale exploration and research discovery programs focused on their gradual implementation and integration, and make their components and design transparent to all users. Only by shifting momentum and direction can we safely begin to understand and implement these incredible feats of human engineering and stave off the sort of disasters that we simply can’t predict at scale right now with the limited knowledge we have available to us.

Paramount Skydance is still aiming to close its roughly $110 billion acquisition of Warner Bros Discovery by the end of September despite a lawsuit filed by 12 state attorneys general seeking to block the deal on antitrust grounds. Jeffrey Kessler, Paramount’s lead trial counsel, told CNBC on Tuesday that the company is prepared to take the matter to the Supreme Court if it faces a prolonged blockade. The coalition, led by California Attorney General Rob Bonta, filed the suit in federal court on Monday and followed it with a motion for a temporary restraining order later that evening.

The lawsuit argues that combining two of Hollywood’s five major film distributors and two of its five major basic cable channel owners would substantially lessen competition across theatrical distribution, cable programming, and the broader entertainment industry. Bonta said in a statement that the merger would lead to higher prices, lower quality, and less content for audiences. The deal had already received clearance from the Justice Department’s Antitrust Division, which concluded in June that the transaction was unlikely to harm competition, making the state-level challenge a direct rebuke of the federal finding.

Kessler told CNBC’s David Faber that Paramount had indicated its intention to close the deal as early as July 22, the date by which the European Union is expected to issue its own regulatory decision. Paramount recently submitted concessions to the EU to address remaining concerns. Kessler said the company offered the states two alternatives, an immediate close or an orderly judicial schedule that would resolve the matter by early September, but the states rejected both.

The financial pressure on Paramount is real. Under the merger agreement, if the deal has not closed by September 30, Paramount must pay Warner Bros Discovery shareholders a ticking fee worth roughly $650 million per quarter until closing. A temporary restraining order, if granted, would pause the transaction for 14 days, and up to two could be issued before the states seek a preliminary injunction that would put the deal on hold for the duration of the litigation.

Kessler argued the merger is pro-competitive rather than anti-competitive, noting that the entertainment industry is in deep trouble as consumers flee pay TV bundles and streaming competition intensifies. He said the combined company would be able to compete directly with Netflix, Disney, and Amazon’s Prime Video. CEO David Ellison has promised the merged entity would release 30 films per year, and Kessler said Paramount is willing to put that commitment in writing.

The deal has already cleared the DOJ and multiple international regulators, and Paramount has been unifying its streaming technology in preparation for absorbing HBO Max after closing. Whether the state attorneys general can delay the transaction long enough to trigger the ticking fee, or block it entirely, will likely depend on how quickly the federal court in Sacramento acts on the restraining order request.

A pair of soft white tubes no thicker than a couple of strands of spaghetti rest in a researcher’s hands. They look almost fragile, yet these fibers can pull with the strength of real muscle, stay completely silent while they work, and run for hours on nothing more than a small battery pack. Researchers at the MIT Media Lab and Politecnico di Bari just published the full details of this system in Science Robotics, and the results feel like a genuine step change for anyone building humanoid robots or wearable machines.

Most robots are still powered by electric motors and gearboxes that simply spin a shaft and then convert that rotation into linear motion in the old-fashioned way, which works fine but has some significant drawbacks: it makes a racket, weighs a ton near the joints, and interferes with how our own limbs function. For years, soft fluidic actuators have been touted as a superior solution: long, flexible tubes that contract when pressed, similar to the muscles in your arm. The issue is with the massive pumps, compressors, and hoses that keep those actuators operating. They simply stop any possibility of a clean, portable design in its tracks.

Unitree R1 Humanoid Robot (White, R1 Air)

• Three models, one lightweight platform R1 Air (20 DOF, monocular camera), R1 (26 DOF, binocular camera, head+waist joints), and R1 Edu (26 DOF…
• Easy setup – no coding required for basic use Unbox, power on, and start. Manual teaching feature: physically pose the robot, and it replays the…
• More DOF = more expressive movement 26‑DOF models (R1 / R1 Edu) add head and waist articulation for smoother dance and running. For safety reasons…

The new electrofluidic fiber muscles solve that problem by actually inserting the pump inside the muscle. Each pump is a tiny tube that is less than 2 millimeters wide. Inside, two thin helical electrodes weave their way along the length, and when exposed to high voltage, they begin to inject charge into a unique insulating liquid known as a dielectric fluid. The charged particles just drag the entire fluid along with them, generating pressure and flow with no moving parts. The entire system is absolutely silent and converts electricity directly into hydraulic power.

These tiny pumps form a closed loop with some thin McKibben-style actuators, which are essentially soft tubes wrapped in a braided sleeve that contract when the fluid inside them expands. You may simply stack one pump between two opposing actuators, exactly like your biceps and triceps operate together. When the pump pushes fluid into one actuator, that side shortens while the other side lengthens. There is no need for an external reservoir, therefore the entire system remains sealed, lightweight, and self-contained.

The performance stats are impressive, with roughly 50 watts per kilogram of power density and fibers that can contract by 20% of their length. When multiple pumps are operated in simultaneously, response times drop to less than 0.3 seconds. They also have a pre-pressure system that keeps everything stable and doubles the stroke three times for the same pump effort, and with the bias pressure, they can exchange a little maximal force for even faster snaps when speed is more critical than sheer power.

To demonstrate how adaptable the design is, the team demonstrated no fewer than three different setups. One of them launches table tennis balls in less than 2 tenths of a second, which is very quick. Another bundles a bunch of fibers together so that a small package weighing only a few dozen grams can lift four kilograms, or 200 times its own weight, with a beautiful clean 30-millimeter stroke. The most friendly-looking demonstration incorporated the fibers into a flat biceps-triceps pair that bends a 3D-printed robot arm in a full 40-degree arc. That same knitted muscle is supple enough to shake someone’s hand without squishing their fingers or feeling stiff.
[Source]

Spotify is rolling out a new AI-powered conversational feature that lets Premium users talk directly to the app about what they want to hear. Users can type or speak a request and refine the results through follow-up questions instead of manually searching for a song, podcast, or audiobook.

The feature is available from Spotify’s Home and Now Playing screens and works much like a personal audio assistant. It can choose what plays, answer questions about the current track or album, recommend something new, and look through your listening history to provide more personalized responses.

What can you ask Spotify to do?

You can ask Spotify to play artists you have not heard before. Follow-up requests can add a particular artist, narrow the selection to recent releases, or make the music more upbeat. The assistant can also save a song, add it to your queue, or follow an artist. It can provide more information about whatever is currently playing. Users can ask when an album was released, what genre a song belongs to, or what inspired a particular record.

The feature also works across podcasts and audiobooks. You can ask Spotify to find more books by an author or pull up other podcast episodes featuring the same guest. It can also look back through your listening history. Spotify says you will be able to ask when you first played a particular song or which genres you have been listening to most recently.

This is not Spotify’s first AI-powered feature

Spotify has been experimenting with AI for a while now, and each feature has brought the technology into a different part of the service. AI DJ is one such feature that creates a personalized stream of music and uses an AI-generated voice to introduce songs and explain recommendations. AI Playlist lets users build playlists from written prompts based on a mood, activity, or genre.

Studio by Spotify Labs can generate personal podcasts and daily briefings shaped around a user’s listening history. Spotify has also announced a separate generative AI tool that will let Premium subscribers create licensed covers and remixes from songs by participating artists and songwriters.

The new conversational feature is now rolling out in beta to Premium users aged 18 and older in the US, Ireland, and Sweden. It is available in English through Spotify’s iOS and Android apps. Spotify says responses may not always be perfect while testing continues.