The genome offers a recipe, not a blueprint, for the brain

Mike's Notes

Agree 100%. Self-organisation is often overlooked.

Self-organisation also occurs in Pipi.

I like the "baking a cake" analogy; it's a good way to explain it.

Resources

References

  • Fiete, I. (2026). The genome offers a recipe, not a blueprint, for the brain. The Transmitter. https://doi.org/10.53053/ZHHE7561

Repository

  • Home > Ajabbi Research > Library > Subscriptions > The Transmitter
  • Home > Handbook > 

Last Updated

10/11/2026

The genome offers a recipe, not a blueprint, for the brain

By: Ila Fiete
The Transmitter: 02/11/2026

Ila Fiete: Ila Fiete is professor of brain and cognitive sciences, associate member of the McGovern Institute and director of the K. Lisa Yang ICoN Center at the Massachusetts Institute of Technology.

...


Cake mix: Genes specify ingredients and a short list of directions, outlining which things to combine, in what quantity and when.

Illustration by Anna Ivanenko

Picture a box of cake mix and then imagine the fluffy, fragrant cake on your plate. Everything about the cake was already, in some sense, “in the box,” yet nowhere in the box will you find the crumb or the aroma of the cake. These qualities emerge only after you add water, turn on the oven and wait. Gradually, proteins open up and tangle, starches dissolve and gel, gas bubbles expand, and Maillard reactions begin. None of these processes are printed on the box, yet their unfolding transforms a set of simpler components into the rich macro-structure of cake. 

I have come to think this is the right way to think about the developing brain. Genes specify ingredients and a short list of directions, outlining which things to combine, in what quantity and when. They don’t specify the border between the secondary visual cortex and its neighbor, or the wiring between each pair of neurons, or the precise size of the cortical sheet in each individual’s brain. Instead, these quantities emerge through the playing out of simpler processes that can lead to the self-organization of complex structures. 

This is an old idea. In the middle of the previous century, Alan Turing and John von Neumann showed that simple local rules, applied over and over, can generate rich structure from simple components. Then, in the 1980s, the genetic revolution arrived, bringing with it the concrete information that embryologists had long searched for, the powerful tool kit of molecular biology, as well as the powerful intuition that genes and the genome specify function. The pendulum swung hard toward genetic instruction.

I think it needs to swing back—not to displace genetics but to circumscribe the role of genes and build a bridge between genetic specification and rich structure. In this modified view, genes set the rules and turn the knobs, and self-organization does much of the rest. 

Two classic ideas typify the concept of genes as a blueprint: Neuroscientist Roger Sperry’s chemoaffinity hypothesis, in which axons find their targets by matching their molecular labels, and developmental biologist Lewis Wolpert’s “French flag” model, in which a molecular gradient specifies locations in a tissue, activating downstream genes at specific concentration thresholds to determine what structure forms there. The fly embryo is the textbook case: A gradient of a protein called bicoid switches on the gap genes, which activate stripes of pair-rule genes, leading to body segments. In this picture, the genome is close to a blueprint.

At the other extreme is Turing pattern formation. Two interacting chemicals, one that activates itself locally and one that inhibits over a longer range, spontaneously break the symmetry of a uniform tissue and produce stripes or spots. This process involves no genetic instruction on where each spot forms or where the stripes’ boundaries lie; the pattern self-organizes. However, the genome can serve as the cookbook, specifying which molecules to mix, and in what concentrations. 

Digit formation supports the role of Turing mechanisms in the development of body shape. James Sharpe’s group showed that digits form as a Turing pattern of Wnt, BMP and SOX9 signaling in the limb bud. Varying Wnt or BMP signaling changes the wavelength of the pattern, such that the embryo grows more or fewer digits. This process does not involve a French-flag-like expression of different genes to specify digit boundaries; instead Wnt and BMP act as simple dials that alter a self-organized pattern’s period. 

Each process involves trade-offs: The chemoaffinity and French flag models scale with body size, but they can be noise-sensitive and require a larger number of genes. Turing patterns are robust and require few genes, but they specify only a single scale. The interesting question, therefore, is not which mechanism the brain uses, but which it uses where and at what stage of development. 

Indeed, even in the fly, the blueprint is somewhat blurry and may receive a self-organizing assist. Thomas Gregor and his colleagues report that multiple gap genes together specify a cell’s position through lateral interactions better than a single gradient without interactions. Thus, one of the most genetically instructed systems we know still relies on network dynamics.

Physical forces also contribute to self-organization: Boris Shraiman, Kenneth Irvine and others have shown that cells sense mechanical stretch and compression at tissue boundaries, and that these forces influence growth and cell fate. Cortical organoids provide a vivid illustration of self-organization: Human stem cells placed in a dish with a few growth factors organize into layered, cortex-like tissue with the cell types arising in roughly the right order.

My own reentry into neurodevelopment (after much earlier efforts on the development of vocal sequences in songbirds with Richard Hahnloser and Walter Senn) came through grid cells.

"The interesting question, therefore, is not which mechanism the brain uses, but which it uses where and at what stage of development."

Grid cells in the entorhinal cortex exist in a small number of discrete functional modules, each with its own spatial scale. However, models of this system presented a puzzle: Modules are discrete, but underlying cellular properties, such as ion channel densities, appear to vary smoothly along the dorsoventral axis. How could a smooth gradient produce sharp jumps? Mikail Khona, Sarthak Chandra and I found that two local interactions, one smoothly graded and one of fixed width, could be sufficient to drive the emergence of modules with abrupt boundaries between them. Through a mechanism we call “peak selection,” we showed that the number of modules would not depend on the size of the network, and module size would scale automatically with brain size and not be fixed by the spatial scale of the interactions, distinct from the outcome of Turing patterning. This simple model can be tested by future connectomics work that maps entorhinal cortical architecture at the synaptic level. The same mechanism can theoretically account for the emergence of other types of modules from smooth gradients. 

A similar lesson holds one level up: To test potential mechanisms of visual system development, we developed, with Talia Konkle, a model in which neurons sprout synapses based on their activity and synapses at each neuron compete with each other for a limited construction budget, in a sheet of cortex driven only by spontaneous waves. This simple process produced discrete visual areas, a processing hierarchy and retinotopic maps, as seen in macaque and human brains. The model predicts no steps or switches in gene expression at higher-area boundaries, only smooth gradients. Researchers can now use spatial transcriptomics to see if these properties exist in the biological system. 

Drawing from these examples, a handful of growth rules and knobs connect the gene regulatory network to circuits and behavior. If accurate, this is good news for our understanding of and desire to control neurodevelopment, because genes can potentially be correlated with simple knobs that provide interpretable control. For instance, changing the relative size or number of cortical areas should not require rewriting a detailed wiring diagram, but only turning one knob. 

It is also, I suspect, why brains are evolvable. Selection cannot efficiently act on complex blueprints, because making a meaningful change would require a large number of specifically orchestrated edits. But it can easily act on a recipe, in which a small change to a dial produces a coherent, whole-organism variation. Evolvable systems are controllable systems.

My colleague P. Robin Hiesinger notes that even the cake analogy may give genes too much credit; typical recipes specify ingredients, as well as the order and duration of steps, but in development, these can themselves be emergent, as seen in the assembly of the sorting plate that guides fly eye neurons into the brain. (For more on this, see Hiesinger’s companion essay, “When is self-organization a mechanism in brain development?”)

Where does this leave the field? We now know there are many more processes in the self-organization tool kit than Turing patterning. We need theorists who treat development as seriously as they treat learning, and who ask what other minimal rules could produce a given structure. We need experimentalists who are willing to think about, look for and measure the hypothesized knobs, such as gradient slopes and interaction widths. And we need transcriptomic and connectomic analysts who examine predictions from self-organization—smooth gradients versus steps and switches, as predicted by blueprints. Most of all, as Hiesinger argues in his companion essay, we need molecular and computational neuroscientists to spend more time in each other’s kitchens.

Critical thing when agents do the work

Mike's Notes

Wise words from Addy. He has written many engineering books; I must read some.

A while back, I made a hard decision to stay in control by handling all the architecture, using Gemini only as a personal tutor and a strong coding assistant, and manually checking every line of code in an IDE. 😎

Often, I get work done in a couple of minutes instead of a couple of weeks. 😎😎

As a result, my skills are improving, and I have more time to read, think, draw and write.

3,000,000 lines of code so far.

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > The Code
  • Home > Handbook > 

Last Updated

09/11/2026

Critical thing when agents do the work

By: Addy Osmani
X: 03/11/2026

Addy Osmani: Addy Osmani is an Irish engineering and evangelism leader and a Member of Technical Staff at Anthropic. He works on Claude Code. He spent over 14 years at Google, most recently as a Director at Google Cloud AI, running Cloud AI Developer Experience and Technical Evangelism and helping launch Google's agent developer platform. Before that he led Developer Experience across Chrome, DevTools, Lighthouse, and Core Web Vitals, and Gemini's developer experience (coding agents, evals, code quality). A developer for 25+ years, and earlier an engineer on Fortune 500 sites, he is passionate about AI-assisted engineering and developer tools. He is the author of books including Learning JavaScript Design Patterns, Leading Effective Engineering Teams, Stoic Mind, and Image Optimization, and has given over 200 talks worldwide. You can find his writing on his blog, Substack, and LeadDev, his code in open source, and him on LinkedIn, Twitter, and TikTok.

...

Critical thinking when agents do the work

Back in the day, critical thinking was taught as approaching new info with humble curiosity and a healthy dose of skepticism - take in different views, form your own opinion. Still true, but increasingly, nothing in my day-to-day forces critical thinking on me now that so much of my work runs through agents. For the engineers and product people who have fully bought into agentic workflows (running multiple sessions in parallel and expecting the models to improve), I'm here to say: I'm a big fan of these tools. I'm not writing this to advocate for less agentic workflows.

My goal is to help you maintain critical thinking in a world where it's easy to offload anything to an agent.

In the past, most of our cognitive and aesthetic processing happened in the space between question and answer. That space is now measured in seconds. The more you use agentic workflows, the more difficult it becomes (though not in the way I think people expected): as the models improve, the percentage of obvious errors is lower. Many (most?) outputs will be well-written and mostly correct, but they won't demand a second look.

Even if you are running many agents at a time, you still only have one pair of eyes on the outputs.

You have to build critical thinking into your day, because by default nothing will do it for you.

Part of the reason it's hard to self-correct for this is that agentic workflows are pleasant. Getting fast, pleasant, often-correct answers is refreshing in a busy day, but that's also why it's easy to relax your vigilance.

Offloading, deferral and surrender

When discussing this with people, I describe it as a spectrum:

At the top: cognitive offloading, the act of delegating tasks to the AI, but maintaining ownership of the result. I do this all day. You should, too. In the middle: deferral, where the output of the tool becomes your new input; the result has ceased to be a hypothesis. At the bottom: cognitive surrender - the AI's output quietly becomes your own, you feel no need to check it.

Cognitive surrender is a term coined by Steven Shaw and Gideon Nave at Wharton. It fits neatly what I've been seeing: as trust (or laziness) increases, people drift down the spectrum. The transition is rarely observed, because the steps are each gradual and seem reasonable. You read the last answer well, so you skim the next one. You just scan the skeleton of the one after that. Then you get asked about a line and can't explain it, even with your agent's help.

That's cognitive surrender. It's how cognitive debt accumulates. It's usually discovered when you try to apply a mental model of the system and it doesn't exist. Margaret-Anne Storey has written about how this shows up in teams as an eroding understanding of a shared system theory. I've written about the code equivalent, comprehension debt (a term coined by Jeremy Twei). In the moment, it's completely invisible. The codebase looks pristine and the tests pass. It doesn't become obvious until you have to make a change to the system and realize that nobody understands it anymore. The same applies when you've read the table of contents of a strategy doc or spec and signed off on it.

To be clear, I'm not advocating for the impossible. It's impossible to maintain the full mental model of a large modern codebase. The Claude Code team has said publicly that they rebuild understanding on demand: when they need to understand a part, they ask Claude to explain that slice, rather than holding the full model in their heads. As I've written about before, this sort of debt is more recoverable than most engineers expect. You don't need to maintain the full model as long as you can rebuild it locally as needed. You just need to know what you don't have.

Where the stakes are low, feel free to delegate entirely. When you can't explain the answer to a question, even by way of your agent, you've ceded ownership.

This isn't always a problem, either. Just recently, I was recording a course and had to select one out of three similarly-rated hotels to use as a recording location. I didn't have time to manually review all the reviews, so I delegated the decision to an AI. It worked, and I'd do the same thing again. However, I wouldn't do that when deciding how to invest our money, how to advise our kids on their careers, or at work: what we should build, what changes affect what users, whether it's safe to ship. Take the handoff where being wrong is cheap, keep the reasoning where others will have to deal with the consequences.

The questions I ask myself

When I didn't know what I thought, I'd usually go back to a basic list of questions like these: How do I know that I'm working on the right problem? How do I know that I'm solving it the right way? Is there evidence that supports my conclusion? How do I know that I'm finished? Most times, this is just who, what, where, why, when and how. When written out, it looks absurdly child-like, but it forces you to think in terms of categories that you'd otherwise ignore. These days, it's too easy to simply skip all of this and ask your agent what it thinks you should do. These are the new versions of these questions that I ask myself now.

Did I formulate a hypothesis before asking? Before I run an agent on any non-trivial task, I write down, even just in my head, what I think the answer might be. It's OK if it's a bad guess. You're always welcome to change your mind in light of new information. Once you've read a well-written response, though, it's hard to imagine any other possibility. If you have no guidance whatsoever, ask for what Thariq Shihipar calls a blind spot pass: give the model what you know and have it find your unknown unknowns.

Am I asking it to help me think or to offload thinking from me? Both are OK, as long as you know which one you're doing.

What would have to be true for this to be wrong? Then go find out. A model's self-assessment of confidence is much less valuable than an actual test you can perform, so give it one.

Have I heard the counter argument from a different angle? When I've taken a hard stance on something that's somewhat open-ended, I'll ask more than one model to argue the opposite side, then review the output and form my own opinion. This takes longer, but I end up knowing much more about the subject.

Would I bet on this in front of the person who has to maintain it? This applies to code and to anything else that you're delivering. I believe that this is the bar for answerability.

What am I no longer practicing? Maybe it's some of the routine debugging. I'm OK with letting some of that go, but I want it to be intentional.

Verification as a habit

I've been writing a lot about verification lately because I believe that the bottleneck has shifted from coding to being sure you're right. When you give an agent the means to verify what it's doing, whether that be by way of end-to-end tests, property tests, or by way of actual app interactions, it can make a change, run the verification test, read the output, and attempt again all before you've looked at anything. This is what Boris Cherny calls "give Claude a way to verify its work" and I believe that this is one of the most critical components of achieving great results. Rather than reading every line, you'll be building these loops and reviewing the evidence.

You can also surrender verification. "Is there evidence that supports my conclusion?" becomes "Did the check turn green?" Agents make it so cheap to create tests that you'll see a lot of green, and you could have a passing test that doesn't catch a broken feature. If the test is written with the same mistake as the feature, it'll pass. And a green check only conveys one property. It's too easy to imagine it covers everything.

When a check goes green, ask what it proved. Then ask what it didn't.

Define "verified" upfront, because post-facto, you'll rationalize any outcome.

The finish line for agent work should be something tangible: a test passing, a screenshot, a log or trace. This ensures that the criteria for finishing the work is factual, and not up for interpretation (and surrender) based on something like "it looks like it's done." When you receive a finish notification from an agent, before you look at the summary, first review the code snippet of the command executed and its output.

Claude Code can also self-critique (via a subagent in a fresh context) its own work as a sanity check, and it's worth baking that into the loop so it runs every time, not just when you remember. I still ask at the end "Did I miss anything?" That sounds silly, but so often, when I finish some complex feature work using a frontier model, look at it, review it, and then ask, "Did I miss anything?" It will then come back with two or three more things. That's why I always ask.

None of this needs to be the norm, of course; knowing when to go deep is a skill. My favorite rule of thumb from our write-up on how the Claude Code team does code review is: "If you can't say what the checks would miss, ask for a real review rather than a quick approval."

This applies beyond code as well. If an agent has synthesized fifty customer calls for you, or a competitive analysis, check a couple of the source documents to make sure the summary is accurate. Check a number that your recommendation depends on to make sure it's being calculated correctly.

Agents have made verification cheap to set up. What's difficult for you is knowing what good verification looks like.

Actually paying attention to what's generated

Say an agent gives you a 600-line PR. You roughly look at the structure. You don't read every line. The variable names look reasonable and the tests pass, so you approve it. But somewhere in the middle there's a subtle ordering change in a transaction boundary, or a flipped default on an edge case you never thought about. You did review it, I guess, but only for what you already knew you'd find.

Writing code and reviewing it are different skills, and there's a point where reviewing turns into rubber stamping. So read the diff as if the AI didn't write it, and then look past the diff at what the agent decided. Over a long session it makes a lot of small decisions for you: the defaults, what's out of scope, which requirement it reinterprets when two of them clash.

You won't see any of that in a summary that says everything went well, so ask it to list the decisions and assumptions it made. Then quiz yourself. Pick a few lines at random and ask, what about this line? What about that one? For a document, close it and try to write out the main argument from memory. Some have a habit I like for long sessions: have Claude write a report on the change, and then give you a quiz at the bottom, where the rule is "I only merge after I pass the quiz perfectly."

Understand what you're shipping well enough to defend it. Because at some point, someone could ask.

Agents can also guard your attention. For example, I have an open source project that receives a lot of pull requests. I'll use agents to help determine what's incoming, what's contrary to our guidelines, and where my attention is likely required. I rarely let the agents self-determine this, but they can narrow it down to where I should focus my attention, and then I can actually think about whether these changes are solving the right problem in the right way.

Then there's volume, and you have to be honest with yourself about it. I've called this the orchestration tax. It's the gap between what your agents generate and what you'd feel comfortable putting your name on. If finished work is piling up faster than you can get through it, another session won't help until you've fixed that: tighten the checks so less of it needs you, or slow down.

When you're producing more than you can stand behind, you're no longer reviewing. You're hoping.

Quality in, quality out

The human mental model is still involved, but instead of in the middle, it's at the front and end. You're putting your energy into the front-end of the task description and context, as well as the back-end of reviewing the output. This is why good input is so important to the quality of output, and I view good prompting as a critical thinking skill.

Historically, if you made a non-specific request, someone would challenge it, and you might realize, "Oh wait, I actually didn't figure this out." An agent often won't stop you there. It fills in what you left out and hands back something that looks done, even though the idea behind it is still fuzzy. I've written about this as intent debt, the implicit goals, constraints and rationale that may exist in artifacts you didn't write. Unlike other kinds of debt, nobody else can fix this one for you. The intent has to come from you.

Your prompt is a reflection of your understanding of the problem, and if you can't express it clearly, it may not be clear in your own mind.

Write your own request brief in your own words before you ask for help. Describe the audience, out-of-scope items, and the definition of done. When your second round of corrections hasn't got you there, stop tweaking and rewrite your prompt.

You can have the agent help you with this too. I like the distinction Andy Clark makes between delegating to an AI system and collaborating with it. In the latter case, you're in a virtuous cycle of mutual amplification: your prompts sharpen your output, sharpen your next prompt and sharpen your mental model of the problem. If it's not clear, ask the agent to interview you about what it doesn't understand. If you close the session having refined your own mental model, that's a sign of success.

Also be careful about the input. It's easy for each agent to just pass the previous agent's summary into its context, and before long the third agent hasn't read the original document.

You also need your own standards for output. I've played around with AI in lots of different creative mediums, and most of it never gets shown because it doesn't meet my standards. Things are all coming out nicely formatted and confident, so polish is no longer a useful signal.

AI may have made it faster to produce, but if I wouldn't feel comfortable attributing the output to myself, I won't output it.

When something doesn't meet your standards, note why in shared config, a hook or a test so that it doesn't happen again. That's how taste compounds, and noting why something didn't make the cut is good practice on its own.

"But the models will be better at this than me"

If you're as bullish on the future of this space as many people around me are, you've probably had this thought for a couple of sections. In a year or two, the model will be able to detect what I'd be able to detect, so why bother maintaining the skill?

You may be right on a lot of that detection, and I've been arguing for increasingly pushing detection to agents myself. But here's why I think it still matters: at the end of the day, someone is responsible for what ships. Regardless of how much AI helped, a human has to take responsibility.

The question of how much to trust an agent for any given task is itself a judgment call. Part of staying calibrated is reviewing the work, because what the models get wrong keeps changing. Anthropic's own research on its engineers and researchers calls out the trap as the paradox of supervision: "supervising Claude requires the very coding skills that may atrophy from AI overuse."

These are some of the things that matter most to me and that a better model won't solve: what are you building, why is it worth it, who does it impact and what are you willing to sacrifice? Those are all questions you need to answer. An agent can be helpful in working them through, and I would like it to be, but ultimately they're still yours.

You may offload the work and much of the auditing, but not the accountability.

Practices for the everyday

You don't need to do all this rigorously. Just plug in what works for your workflow.

Once a week, write a bit of code without an agent, or do one real thing that would suck if you forgot how to do it. (I've called this a calibration exercise, but I don't mean it as a moral one.) Once a month, write down what you've stopped doing and decide which of those you're okay not doing. One question from an old blog post of mine remains as valid as ever: How lost would you be if AI didn't exist?

If something is above your comprehension, go learn it. If I'm writing and I run into a phrase I haven't seen before, I could Google a one-line explanation and include it. I prefer to do a little research to properly understand it, so I can see where it fits.

Checking the machine properly is real work, and pretending otherwise is how teams end up not doing it. It isn't free, so schedule it as a line item and you'll actually get it done.

Skills that you stop exercising are going to go away, and probably faster than you might guess. Keep doing the ones you're not willing to let go.

What to bring with you

  • Be intentional. An agent can quiz you, interview you and show you its evidence, but only if you set that up. So set it up.
  • Be honest about your place on the spectrum. If you can't explain the answer, even with an agent's help, you've surrendered it.
  • Have a hypothesis. Formulate one before asking, even if it's bad.
  • A green check means one thing. What did it check? What did it not check?
  • Look for evidence. Read what it ran and what it returned before reading the summary.
  • Read to know what decisions it made. What did it decide for you?
  • Craft your prompt. How you write what you prompt shows how much you understood the problem.
  • Set a bar, and stick to it. If you wouldn't put your name on it, it doesn't go out.
Keep yourself in the game by manually applying the skills that matter. One thing you could do: Before you ask, write down what you think will happen, and after the agent is done, write down one thing it didn't check. Let me know if that changes the way you read the output. Think independently. Ask better questions. Take responsibility for the outcome.


The PHP2Shell Vulnerability Heralds Cybersecurity Hell

Mike's Notes

Wiz looks impressive.

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Suhscriptions > IEEE Spectrum
  • Home > Handbook > 

Last Updated

08/11/2026

The PHP2Shell Vulnerability Heralds Cybersecurity Hell

By: Dina Genkina
IEEE Spectrum: 02/11/2026

Dina Genkina: Dina Genkina is the computing and hardware editor at IEEE Spectrum. She holds a PhD in atomic physics and lives in Brooklyn.

...

AI is forcing us to pay off 40 years of technical debt

...

In late October, a slew of major cybersecurity issues came to light. But none were bigger than the so-called PHP2Shell vulnerability, which put a plethora of websites, including those of NASA, Wikipedia, the White House, and all other sites that run on Wordpress or Drupal (among others) at risk of exploits capable of both reading sensitive data and running malicious code on the host server.

As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation, and a patch was released before any bad actors got their hands on the exploit. However, PHP2Shell may be the canary in the coal mine, serving as a warning sign for what’s to come in the age of AI.

“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed,” says Matt Suiche, AI security research lead at the cybersecurity startup Tolmo. “Now it is time for the technical debt to be paid off.”

PHP Legacy Bug and Memory Errors

PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites. The bug underlying the PHP2Shell vulnerability was reported to the PHP Foundation as far back as 2024. The bug caused a common type of issue called an out-of-memory error, in which the amount of memory allocated to a piece of data is too small to hold the data. Normally, this type of error causes the program to crash—an unpleasant but not inherently dangerous result. And so the bug remained unaddressed.

“If you look at any at any point of time, there will be a bunch of bug reports that are waiting to be fixed, which are just crashes. Most people don’t take them very seriously,” says Suman Jana, an associate professor of computer science at Columbia University.

“It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.” –Suman Jana, Columbia University

Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, allowing a malicious actor to install malware or read critical data. Now, it was no longer a minor bug—it was a critical vulnerability, and the Calif team alerted the PHP foundation to start working on a patch immediately.

Jana says actually exploiting the bug requires carefully working out a way to jump to a specific point in the memory for a particular program running on the server, and work out exactly which bits to overwrite in what order to gain control of the system. “It’s not really rocket science,” he says. “It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.”

To be clear, the researchers at Calif (as well as OpenAI and Wiz, a cybersecurity company that confirmed and expanded the vulnerabilities) had deep knowledge of both cybersecurity and the PHP language. “I’m not claiming that AI can do it all by itself. It clearly cannot,” Jana says. “But it is improving a lot, so the top 0.1 percent [of experts] can get a lot more stuff done, and also just below the 0.1 percent now will be able to go there without understanding all the nitty-gritty details.”

AI Tools and Formal Verification in Security

After the exploits were disclosed to the PHP Foundation, a team of four engineers spent two months developing a patch to release as quickly as possible.

“There is a fundamental asymmetry in finding bugs and fixing bugs,” Jana says. “Because when you’re fixing bugs you have to make sure that you know all parts of that attack are closed, and also that you don’t break any existing functionality.”

This asymmetry puts a lot of strain on the defenders, especially for open-source software such as PHP. Maintaining open-source projects that don’t have clear revenue streams despite being widely used is a long-standing challenge that precedes AI hacking tools. But those tools make the issue more pressing than ever.

One way to stay ahead of such issues going forward is to empower the defenders with more money and access to frontier cybersecurity AI models. “These frontier labs are donating some of their token budgets to look into these bugs, which I think is great,” Jana says. “I think that should happen more, either through some concerted effort or through donations.”

Jana is also optimistic that formal verification tools to automate the patching side of the equation are also advancing quickly, including a new release from Anthropic on 22 October. “The patch is LLM-generated, and then an LLM generates the proof that the patch is correct,” says Jana. “The only thing not done by an LLM is the proof checker, because somebody has to check the proof, because LLMs hallucinate. So, you want something that is formal.”

Hopefully, the combination of specialized AI models and formal verification tools will make patching vulnerabilities nearly as automatable as finding them.

Matthew Green, an associate professor of computer science at Johns Hopkins University Information Security Institute, is less optimistic. “Nobody’s going to fix this problem until something really bad happens,” he says. “And PHP2Shell wasn’t bad enough to be really bad. So when something really bad happens, which is going to be maybe sometime in early 2027, something bad that normal people are upset by, then suddenly people will start doing this. We’re going to fund everything.”

In the meantime, Green says, update your software. “If your phone is like, ‘Hey, there’s a security update available, do you want to install it,’ don’t wait till next week. Just do it.”

One thing’s for sure—PHP2Shell is just the beginning. “This won’t be the last one for sure,” Jana says. “It’s just who finds it. Hopefully, the white-hat hackers find it first, like this one.”

The Wonder-Driven Builder — with Paige Bailey

Mike's Notes

Paige Bailey presented at the Gemini 4 Argon Launch: Founder Briefing on Thursday. The briefing was very interesting.

I got curious about Paige because she has a personal project at the Computer History Museum. One of her demos used Gemini 4 to create a video for the museum about Grace Hopper. One day, I hope to visit the museum and maybe meet Paige at a conference somewhere. 😎

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > Google Rising Founders
  • Home > Handbook > 

Last Updated

07/11/2026

The Wonder-Driven Builder — with Paige Bailey

By: 
Posit PBC: 10/06/2026

...

Paige Bailey is a developer relations engineering lead at Google DeepMind, a geophysicist-turned-AI-engineer who was once told by her professors that building open-source libraries was a waste of time. We talk about her path from planetary science to TensorFlow, why statisticians have a hidden edge in the age of AI, and what it means to be a curious generalist when the cost of building software is approaching zero. Bonus: installing solar-powered silent-film birdhouses as street art in San Francisco.

Paige Bailey (Google DeepMind) takes us from her rescued Apple II to GPU-accelerated geophysics simulations to the quiet thesis running through all of it (that the most interesting things happen at the intersections). We chat about why statisticians’ tolerance for uncertainty might be the most underrated AI skill, and Paige makes the case for getting roasted for your own music taste.

What's Inside:

  • From planetary science to TensorFlow, before it was GPU-capable
  • Geophysicists as early GPU adopters
  • The professors who said open-source wasn’t “real science”
  • Building silent-film birdhouses as San Francisco street art
  • Hiding Gemini API tests inside whimsical side projects
  • The right-tool-for-the-job case for mixing AI models
  • Why “taste” is the skill that matters when code costs nothing

The Wonder-Driven Builder — with Paige Bailey

The Test Set (YouTube) 48:17

Electronic health records explained

Mike's Notes

An excellent ISO description of the differences between EHR and EMR for the healthcare sector.

Workspaces for Health should be able to meet all the EHR standards described here.

Resources

References

  • ISO 13606-1:2019 Electronic health record communication — Part 1: Reference model
  • ISO 13131:2021 Telehealth services — Quality planning guidelines

Repository

  • Home > Ajabbi Research > Library > Subscriptions > IOS Insights
  • Home > Handbook > 

Last Updated

06/11/2026

Electronic health records explained

By: 
ISO Insights: 05/11/2026

...

A diagnosis, a prescription, a lab result, a discharge note: each records one moment in a patient’s care. The challenge for healthcare organizations is turning those separate moments into a dependable account that professionals can use wherever the patient is treated.

Electronic health records (EHRs) provide that continuity. An EHR is a digital record of a patient’s health information that develops over time and is designed to support care across different healthcare settings. It brings clinical and administrative information into one structured record, giving authorized users a clearer view of the patient and the care already provided.

For healthcare providers, this isn’t simply a question of replacing paper. EHR systems support clinical performance, coordination between services, operational efficiency, patient participation and the governance of sensitive information. To understand what EHRs can deliver, we need to look beyond the digital record itself to how information moves, how clinicians use it and how it supports the decisions that shape patient care.

What is an EHR?

The EHR meaning goes beyond digital recordkeeping: it is about connecting information to support a person’s care over time. Each diagnosis, test result and treatment adds to a clinical history that authorized professionals can draw on across healthcare settings. This gives them the context to make informed decisions and maintain continuity as the patient moves between services.

Although the content varies, an EHR typically includes:

  • A patient’s medical history and diagnoses
  • Medications, allergies and immunizations
  • Laboratory results and medical images
  • Treatment and care plans
  • Clinical notes, referrals and discharge information
  • Appointments, insurance and billing details

Together, these elements provide a shared basis for clinical decisions, coordination and follow-up, while sound information governance protects patient privacy and supports regulatory compliance. The key difference with an electronic medical record (EMR) is scope: an EHR is designed to support care across organizational boundaries.

EHR and EMR systems: the key differences

An electronic medical record, or EMR, is the digital equivalent of a patient’s paper chart, generally maintained by a single provider or healthcare organization. It supports clinical and administrative work within that setting, from documenting diagnoses and treatments to managing prescriptions and follow-up care.

An electronic health record, or EHR, has a broader reach. When systems are interoperable, information can follow the patient between primary care providers, specialists, hospitals, laboratories and other services. This gives professionals a more complete clinical picture, improves coordination and reduces the need to recreate information at each stage of the patient journey.

For healthcare organizations, this distinction matters because it affects what they need from their EHR system; supporting internal workflows is different from exchanging information that other providers can securely access, interpret and use.

What is EHR software?

EHR software is the technology used to create, manage and use electronic health records. It gives healthcare professionals, administrative teams and patients the tools to work with the information in those records, while supporting secure exchange between providers. Its configuration depends on the setting: inpatient systems must accommodate complex hospital workflows and coordination across departments, whereas outpatient – or ambulatory – systems serve individual practices, clinics and other non-hospital services.

Whatever the environment, core features include:

  • Patient records: tools to capture, organize, update and retrieve structured patient information
  • Orders and prescriptions: electronic ordering of tests, medications and treatments, with easy access to test results and reports
  • Decision support: alerts, prompts and evidence-based recommendations that help healthcare professionals make informed decisions at the point of care
  • Information exchange: secure sharing of information with laboratories, pharmacies and other authorized providers and systems
  • Privacy and security: identity management, access controls and audit trails that protect sensitive information and record how it is used
  • Billing and payments: functions for coding, claims processing, invoicing and payment management
  • Patient access: portals or applications for viewing health information, managing appointments and communicating with care providers

In practice, these features must work together, support daily workflows and meet the organization’s clinical, operational and regulatory requirements.

Benefits of electronic health records

EHR systems address a persistent problem in healthcare: fragmented information. When patient histories and test results are scattered across systems, professionals lose time, decisions are delayed and work is duplicated. EHRs help reduce these inefficiencies by making reliable, up-to-date information available when and where it is needed.

At the point of care, a fuller view of diagnoses, medications, allergies and previous results helps healthcare professionals identify risks, avoid unnecessary investigations and make informed decisions. Treatment can reflect the patient’s wider clinical history, rather than a single encounter.

Across the organization, shared information improves coordination between teams. Connecting documentation, appointments, prescriptions and billing reduces manual processing and opportunities for human error. More efficient workflows can lower costs and free up resources, while access controls and audit trails strengthen EHR privacy and accountability.

For patients, this can mean less repetition of their health history, fewer delays caused by missing information and care that is better tailored to their needs. Secure access to records also helps them understand their treatment and participate in decisions about their care.

More engaged patients

EHRs give patients a practical way to stay involved between appointments. Through patient portals, they can review test results, check medications and treatment plans, prepare questions for consultations and flag errors or omissions in their records. They can also share access with family members or caregivers who support their care.

For people managing long-term or complex conditions, these tools can help them track progress and follow through on treatment. Providers benefit too: patients arrive better prepared, discussions can focus on specific concerns, and care instructions remain available after the consultation.

Access alone, however, does not ensure patient engagement. Information must be clear, explained in context and designed for people with different language needs, levels of health literacy and access to technology. Healthcare organizations must also manage identity, consent and caregiver permissions carefully to protect EHR privacy. The true measure of success is whether patients can use this information to ask informed questions, make decisions with their care team and manage treatments between visits.

EHR systems: usability and workflows

Professionals also need information they can readily use. For those working with EHRs every day, that means being able to find, understand and act on it quickly and easily. If entering notes, reviewing results or ordering tests requires too many steps, productivity falls, data quality suffers and the risk of error increases. Effective EHR software reduces this friction, allowing health professionals to focus on care.

Usability must be considered across the organization. Clinicians need to document treatment and retrieve relevant information quickly, while administrative teams rely on the system to coordinate services, manage appointments and complete other essential tasks. The EHR interface must make these tasks straightforward, with clear navigation and consistent processes.

Introducing an EHR system is also an opportunity to improve workflows. Simply moving existing processes into a digital environment can carry over unnecessary steps and delays, so testing realistic clinical and administrative scenarios helps organizations find ways to simplify work and make information flow more smoothly between teams. Training and ongoing support then help staff use the system confidently as their work evolves.

Making EHR systems work

Achieving electronic health record benefits takes careful planning and effort. Organizations need to manage the disruption of introducing a new system, then commit the resources needed to keep it secure, reliable and useful.

During implementation, priorities include:

  • Funding and capacity: EHR software, hardware and integration require substantial investment, while migration and training draw on staff time alongside normal duties.
  • Reliable migration: Existing records must be transferred without losing information or carrying unresolved errors into the new system.
  • Staff readiness: Teams need role-specific training and workflows that allow them to use the system confidently without disrupting care.

Once the system is in use, the aim is to keep it working effectively:

  • Data quality and exchange: Records must remain accurate and current, and information must retain its meaning as it moves between systems and providers.
  • Security and privacy: Access controls, monitoring and clear governance are needed to protect sensitive information and maintain EHR privacy.
  • Service reliability: Infrastructure, backups, maintenance and ongoing support must keep information available when it is needed.

While many of these challenges can be managed internally, exchanging patient information across providers calls for a shared approach to recording, interpreting and protecting data. International Standards help establish that common foundation.

Standards for connected care

For an electronic health record to support connected care, the systems behind it need to interpret information consistently. A laboratory result sent to a hospital, for example, must retain its structure, meaning and context – and remain protected throughout its journey. International Standards help make this possible, so that information shared between systems remains understandable, usable and secure.

Within ISO, the technical committee on health informatics (ISO/TC 215) leads this work. Its broad portfolio includes the ISO 13606 series for exchanging EHR information, alongside standards covering architecture, terminology, data quality, interoperability, security and EHR privacy. Together, these standards provide a common foundation for sharing and protecting health information, so reliable data is available where and when it is needed.

  • ISO 13606-1:2019Electronic health record communication — Part 1: Reference model
  • ISO 13131:2021Telehealth services — Quality planning guidelines

The path to EHR adoption

A successful EHR transition starts with reliable technology and a clear understanding of the organization’s needs: how care is delivered, how information moves and where existing workflows create delays or uncertainty. These needs guide the choice of EHR software, from functionality and usability to interoperability and the ability to scale.

Once the software has been selected, organizations need a clear plan for the transition, with defined timelines, budgets and responsibilities. In particular, it should set out how data migration and workflow changes will be managed to maintain continuity of care. Planning these elements together helps healthcare providers anticipate pressure points and stay in control throughout implementation.

Staff and patients also need support through the change. Involving staff early, tailoring training to their roles and acting on their input helps the new EHR system fit into daily practice. Patients, too, need to understand what is changing, how to use the system and how their EHR privacy will be protected. A clear explanation of the benefits of electronic health records can build trust and encourage engagement, while continued feedback from both groups helps organizations assess whether the rollout is delivering the intended improvements.

Care you can count on

Every new consultation should be a step forward. For patients, that means less time reconstructing their medical history and greater confidence that the person treating them understands it. For health professionals, it means a clearer starting point for the clinical decisions ahead.

That’s an ambition worth building an EHR system around. As healthcare becomes more digital, success will be measured by how well information serves people: helping professionals exercise their judgement, giving patients a voice and making continuity of care an everyday expectation. Each of these advances brings us closer to the future we want for healthcare: connected, informed and centred on the patient.

Hackertube

Mike's Notes

A great resource.

"Andrej Karpathy builds a YouTube alternative in two hours: The OpenAI co-founder (now at Anthropic) just built HackerTube, a site that surfaces videos the Hacker News community keeps recommending. It sifts through 43M comments to find 6,454 videos worth watching. Inside Claude Code, Opus 5.5 handled the pipeline and deployment, while Sonnet 5.5 did the heavy lifting of labeling comments. Karpathy only stepped in to provide an API key, server, and domain. The labeling reportedly used 504M input tokens, though most were cached." - The Code

PhoenixAI NEXT QUERY 2026

Today, I'm watching PhoenixAI NEXT QUERY 2026 live. Learning heaps. 😎

"PhoenixAI NEXT QUERY 2026 features speakers from Microsoft AI, NVIDIA, Apple, Coinbase, and Intuit; virtual summit Nov 4 9am-4pm PT; free to attend"

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > The Code
  • Home > Handbook > 

Last Updated

05/11/2026

Hackertube

By: Andrej Karpathy
@karpathy: 01/11/2026

Andrej Karpathy: Andrej Karpathy is a Slovak-Canadian AI researcher, who co-founded and formerly worked at OpenAI, where he specialized in deep learning and computer vision. He also worked as the director of artificial intelligence and Autopilot Vision at Tesla, and in 2024 he founded Eureka Labs, an AI education platform.

...

Weekend hack: HackerTube. I was annoyed with YouTube's recommendations so I had Claude filter down 43M comments over 20 years of HN to 6,454 videos that keep being recommended. *Significantly* better viewing experience, ~2 hours with Opus 5.5:

hackertube.org/

  • Excellent recs without any logins (state is kept in local browser session)
  • Thumbnail is a representative frame from middle of the video instead of the super duper A/B test hyper-optimized user uploads
  • Underlying data from the comment analysis as one zip file, point your Claude at it and ask for your own version
  • HackerTube Longs ✊

A bit more on the process:

I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything, the only "manual work" I helped with in tandem was in the browser (reminiscent of MenuGen): 1) I had to create some kind of API key from Google Cloud UI to query YouTube for video metadata, 2) I booted up a VPS box for serving and 3) I bought the domain name. Once the box was up I gave Claude the IP and told it update, secure, harden, deploy and optimize the code, and it did the whole thing.

Many awesome projects that would have normally taken weeks/months even can now be few-shotted for breakfast. What else are we not thinking of.


6:14 PM UTC · Nov 1, 2026 · 3.3M Views

Fully funded international Master's opportunity in theoretical physics

Mike's Notes

Looks wonderful; Go and learn with the best.

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > Perimeter Institute Newsletter
  • Home > Handbook > 

Last Updated

13/11/2026

Fully funded international Master's opportunity in theoretical physics

By: Maïté Dupuis
Perimeter Institute for Theoretical Physics: 03/11/2026

Maïté Dupuis: Director, Training, Educational Outreach and Scientific Programs.

...

I am writing to ask for your help in informing talented physics students about the Perimeter Scholars International (PSI) Master's Program at Perimeter Institute for Theoretical Physics in Waterloo, Canada.

PSI is an intensive, one-year Master's program in theoretical physics offered in collaboration with the University of Waterloo. The program brings together exceptional students from around the world for advanced coursework and research training across the full breadth of modern theoretical physics, including quantum theory, cosmology, particle physics, quantum gravity, quantum information, and condensed matter theory. Students who successfully complete the program earn a Master of Science in Physics from the University of Waterloo as well as a PSI certificate from Perimeter Institute. 

PSI offers several distinctive advantages:

  • Full financial support, ensuring that cost is not a barrier to participation.
  • An exceptionally international cohort, bringing together students from leading universities across the world.
  • Instruction from Perimeter faculty and visiting researchers who are leaders in their fields.
  • Exposure to the full spectrum of theoretical physics before committing to a PhD specialization.
  • Direct immersion in one of the world's largest independent centres for theoretical physics research.
  • PSI is a strong pathway for students interested in pursuing a PhD at Perimeter Institute or other top institutions around the world.

For students considering doctoral studies in theoretical physics, PSI provides a unique environment that combines rigorous training, close interaction with researchers, and an international network of peers who often go on to leading PhD programs worldwide.

We would be grateful if you could share this poster and the above program information with interested students, particularly those who demonstrate exceptional academic ability and a strong interest in theoretical physics.

Applications are accepted online until January 24

Thank you for helping us reach talented students who may benefit from this opportunity.

With best regards,

Maïté Dupuis
Director, Training, Educational Outreach and Scientific Programs
Perimeter Institute for Theoretical Physics

A basket of useful free apps

Mike's Notes

Adding a note so I don't forget where to find these apps. I'm sure I have forgotten some of them. Other recommendations are very welcome, thanks. 😎

Resources

  • Resource

References

  • Reference

Repository

  • Home > Ajabbi Research > Library >
  • Home > Handbook > 

Last Updated

03/11/2026

A basket of useful free apps

By: Mike Peters
On a Sandy Beach: 03/11/2026

Mike Peters: Mike invented and designed Pipi and founded Ajabbi.

...

Here are links to the free web and desktop tools I use a lot. They are all fast and excellent quality. I will add more here in future. I may also give some of them some free ads on future Ajabbi websites to say thank you. 😎

BoxLang

BoxLang is a modern, dynamic, and modular scripting and programming language created and maintained by Ortus Solutions, built to run on the Java Virtual Machine (JVM).

CloudConvert

CloudConvert is an online file conversion utility and API that supports over 200 formats across documents, images, video, audio, spreadsheets, presentations, ebooks, vectors, and archives.

Core FTP

Core FTP LE is a freeware secure FTP client for Windows, developed by CoreFTP.com. Features include FTP, SSL/TLS, SFTP via SSH, and HTTP/HTTPS support.

DBeaver

DBeaver is a SQL client software application and a database administration tool. For relational databases, it uses the JDBC application programming interface to interact with databases via a JDBC driver. For other databases, it uses proprietary database drivers.

FontForge

FontForge is a free, open-source font editor that supports many common font formats.

    Google Blogger

    Google Blogger is a free, web-based content management system that lets you create, edit, and publish blogs.

    Google Search AI Mode

    AI Mode is a search feature used within Google Search. enabling users to input complex, multi-part queries and receive comprehensive, AI-generated responses.

    iNaturalist

    iNaturalist is a free, nonprofit social network and citizen science platform that lets users map and share biodiversity observations globally. Co-founded in 2008, it acts as a digital crowdsourced community connecting nature enthusiasts, hobbyists, and professional scientists to log sightings of plants, animals, fungi, and more.

    NoteTab

    NoteTab is a text and HTML editor for Windows, made by Fookes Software since 1996. Use it to replace Notepad, write and organise notes, edit web pages, or process text with Clips and scripts.

    NoteTab Std 8 and Pro 8 are in beta and will be freeware. NoteTab 7 is no longer sold.

    PostGIS

    PostGIS is an open-source software program that adds support for geographic objects to the PostgreSQL object-relational database. PostGIS follows the Simple Features for SQL specification from the Open Geospatial Consortium. PostGIS is implemented as a PostgreSQL extension.

    PostgreSQL

    PostgreSQL, also known as Postgres, is a free, open-source relational database management system that emphasises extensibility and SQL compliance.

    QRCode Monkey

    QRCode Monkey is one of the most popular free online QR code generators, with millions of QR codes already created. The high-resolution QR codes and powerful design options make it one of the best free QR code generators on the web for commercial and print use.

    Unicodeit

    To convert LaTeX mathematical expressions into Unicode online.

    VLC Media Player

    VLC media player (previously the VideoLAN Client) is a free, open-source, portable, cross-platform media player and streaming media server.

    Wireshark

    Wireshark is a free, open-source network protocol analyser used to capture, inspect, and dissect digital traffic running across a computer network in real time. Acting like a digital microscope for networks, it translates raw binary data streams into a structured, highly readable format. It is the de facto industry standard for network troubleshooting, cybersecurity analysis, and protocol development.