Driven by a desire for privacy, customization, and lower costs, there’s growing interest in AI models which can be run on local hardware. Few of them go as far as [Tim], though, who built an image generation diffusion model which can run on an RP2350 microcontroller.
As might be expected, its capabilities are limited. The resolution is 128×128, it only generates images of human faces, and it takes about twenty seconds per image – still impressive for such limited hardware. It runs on a Waveshare RP2350 development board, and it can output the generated image over USB or display it with the aid of a VGA adapter board.
The generative model doesn’t directly create an image. Rather, it generates a distribution in a latent space, which a variational auto-encoder’s decoder component translates into an image. The auto-encoder was trained in two parts: an encoder which transforms an image into a latent-space distribution, and a decoder to transform that distribution back to an image; once this was trained, only the decoder was used.
The generative portion of the model uses a latent flow diffusion transformer; this takes in noise to start with, then iteratively predicts changes which bring it toward the desired image. It can also take in a output class, which guides the generator’s direction (toward a smiling face, for example). [Tim] trained two models, one larger and one faster, and quantized the weights for both to 8-bit integers. Both models, along with the inference program, then fit into 4 MB of flash memory.
For such a small model, the results are remarkably good; they don’t look quite natural, but they’re quite recognizable. For more on how diffusion image generators work, check out our article on Stable Diffusion.
What if the organization and storage benefits of tool shadowing could be had and improved with a modular, semi-automated process? Tracefinity attempts that by generating custom Gridfinity bins from photos of tools, and has quite a few nifty features that are worth a look.
Maintaining a library of tools makes it easy to create project-based custom layouts.
The basic workflow is this: place one or more tools on a sheet of paper, take a photo, then upload the photo and have the system trace and save the outline and add it to a private tool library. When one is ready to create some bins, use the library of saved tool outlines to generate custom Gridfinity layouts.
If you’re unfamiliar, Gridfinity is a modular system of standardized bins and baseplates designed with 3D printing in mind, making it an ideal match for highly-customized organization tasks and a particularly natural fit for a tool-tracing system like this one.
The idea of taking a photo of a tool and generating a custom bin is a compelling one, and a couple years ago we covered a project that did just that. Tracefinity seems like a natural evolution of the idea, and includes handy features like easy design adjustments, optional magnet holes, and we really like the concept of a tool library from which individual tools are scanned once then later selected to create specific, project-based layouts.
Tracefinity takes advantage of new software capabilities like machine learning to improve and streamline the tracing process, but that doesn’t mean it relies on any external services. It can be entirely self-hosted and by default uses a local, CPU-friendly object detection model for tool tracing. There is an option to provide a API key to use Google Gemini instead, but it’s not required. It can come in handy for especially complex tool outlines or dealing with non-ideal source photos, however.
In the business world, a moat is a quality of a business that makes it difficult for competitors to take that company’s profits. With how hard it is to train models for large language models (LLMs) and generative AI, it might seem like Anthropic, Open AI, and other LLM companies would have huge moats given the amount of compute it takes to build models. But open source models are quickly draining that moat, and now the only thing standing in the way of a customer using one of these models on their own hardware instead one from the larger companies is physical computing resources. [TerminalBytes] demonstrates a few of these models on personally owned computers to show the current state of the art.
[TerminalBytes] started off running the 27B version of the Qwen3.8 on a Mac Studio with 256 GB of unified RAM, which is plenty for this task. But it’s also enough to benchmark a few different models. Qwen3.6 is compared to 3.8, and then the different quants of each model are also compared. Quants are compressed versions of models that need fewer bits to store weights, meaning that the same models can run in less memory with smaller losses in fidelity. Many of these quants run on machines with 32 GB of RAM or less, encompassing many average gaming PCs. There’s even a 1-bit quant that [TerminalBytes] tested which can easily run on a machine with 16 GB, although with mixed results.
Keep in mind that this is just the current state of affairs with open LLMs. Future versions of these models are likely to optimize the number of tokens produced per unit time, or otherwise increase quality of responses while requiring less computer resources. We don’t really think that the ease of running local models will be the sole reason that the AI bubble pops, though. The fact that not every computer user is running Linux is proof enough of that.
As children, many of us looked wistfully into the cockpits of heavy machinery, wondering just how the series of knobs and levers would do something like operate a bulldozer, crane, or excavator. The nature of these myriad of hydraulic and electronic controls for equipment like this is often inscrutable to adults as well; it takes a considerable amount of training to be able to competently operate most of these machines. But this new controller from MIT may help shorten that training time.
The controller is specifically meant for excavators. In a standard excavator, a pair of joysticks is typically used, with one controlling the swing and the boom and the other controlling the stick and the bucket. Getting used to this combination can take practice, so instead the group of researchers replaced them with a model excavator arm that the operator controls directly with their own arm. The new controller is more intuitive to use as it translates the movements of the model to that of either a real excavator or a training simulation.
The researchers plan to include haptic feedback in future versions, which will hopefully further increase the ease of which new operators can get a feel for using these machines. For those not working towards a new career or an ambitious weekend with rental equipment, there are some other ways of learning how to operate excavators and other pieces of heavy machinery.
Over the last few days, people who were trying to do everything right lost their Bitcoin. They bought a respected hardware signer, generated a seed offline using that device, and trusted the device to do the one thing a signer exists to do: produce a number no one else can guess. The Coldcard did not. A preprocessor guard that checked the wrong thing had quietly routed seed generation to a weak software PRNG (pseudorandom number generator), MicroPython’s Yasmarang, instead of the hardware entropy source. On some models the effective entropy collapsed to around 40 bits. The flaw shipped in March 2021 and sat in publicly readable firmware for more than five years. Attackers swept 500 addresses before anyone understood why; within days Galaxy Research’s tally reached 4,585 addresses and nearly $90 million; the attack is ongoing as of the date of this article.
Coinkite’s working assumption, with wide agreement on X, is that someone used AI to comb the publicly available firmware to find the bug. Whether or not that’s how this attacker found it, the next one will. While an AI-assisted audit was run weeks before the theft, it found nothing (potentially due to the capabilities of the model, potentially due to the specific construction of the search). Since the attack started, researchers have shown several frontier models locating the same flaw in minutes from a single prompt. The code sat open to human review for five years and no human caught it.
In the age of highly skilled AI, everything that is distributed is readable, or soon will be. Strip a binary of its symbols, run it through a decompiler, and out comes the pseudo-C that greets anyone who has opened Ghidra: nameless variables, flattened control flow, functions labeled FUN_00401a20. Unreadable to most people. That high barrier to human understanding was the entire security premium of “closed source.”
A compiled program has no choice but to tell the truth. Code that stays encrypted cannot run. At the moment of execution the processor must receive the actual instructions, so whatever the program does, it hands the machine a complete and exact account of how to do it. The information is all there in the machine code. Obfuscation does not, and cannot, remove it.
If reading a binary sounds too hard for a machine to master soon, weigh it against what machines are already doing to problems far harder. Reading a binary is analysis: every fact you need is in front of you, and the work is extraction. Mathematical invention is another order of difficulty, because it demands an object no one has ever seen. At 02:19 UTC on July 20th, Levent Alpöge, a mathematician working with Anthropic’s Claude Fable 5, posted a counterexample to Keller’s Jacobian conjecture, a problem open since 1939 and hard enough to sit on Stephen Smale’s list of challenges for the twenty-first century. Generations had tried it. The disproof is three polynomials in three variables. Lean verified it within hours, and it is short enough for anyone to confirm in a computer-algebra system in about a minute.
Set that pace beside the modest task of reading machine code already sitting out there on the Internet. Today’s models handle source and decompiler output better than raw bytes, so a fully closed binary keeps a thin margin. That margin is a cost speedbump, and it is eroding at the speed you are watching everywhere else. Betting security on how long it lasts means betting against a clock that is only speeding up.
The same capability that finds your entropy bug reads your proprietary method. This is the quieter casualty, and it impacts companies that never thought of themselves as exposed to open-source anything. Trade secrecy in shipped software was always just obscurity in a suit. The law has said so for as long as trade-secret law has existed: reverse engineering a product you lawfully possess is fair play, and therefore a secret survives only while that reverse engineering stays expensive. When the cost of extraction falls to a subscription and a prompt, the secret embodied in the code you hand your customers stops being one. Your clever algorithm, your undocumented format, your edge in the binary: legible to anyone who cares to look, on a timeline increasingly measured in minutes.
None of this necessarily makes open source safe. Heartbleed hid in the most widely deployed TLS library on earth for two years, because visibility without funded attention finds nothing. The xz backdoor showed that the open contribution model is itself an attack surface, one a patient adversary can walk through with a friendly face and two years of good commits. While openness once was a shield, it is no longer. What it does buy is reviewers who are permitted to look, builds which can be independently reproduced and verified, an exit when a vendor dies or turns, and acknowledgment that this all will happen whether you like it or not.
Now we must assume every line shipped will be read by someone who wishes harm, because it will be. The defender holds one structural advantage the attacker never will: time. You can turn the same frontier models on your own code before release, in the space between commit and ship, while the attacker waits for a binary that does not yet exist. Make your builds reproducible, so it ties back to the source and the source can be checked. Design to fail closed, and keep the trusted core small enough that one bug cannot take everything. For the specific business of holding Bitcoin, learn the lesson Coldcard is teaching in real time: own the entropy you cannot afford to have guessed, keep the secure element minimal and behind a published interface, and spread your keys across independent implementations, so that no single device, and no single vendor’s mistake, is the whole of your exposure.
For Bitcoin the stakes are unforgiving in a way they are not elsewhere, since mere knowledge of the private keys grants possession. The entropy bug has left permanent scars. Patching the generator does nothing for the seeds it already produced; a weak keyspace stays sweepable forever, and disclosure hands the attacker the recipe. We have watched this before. The Milk Sad vulnerability in the libbitcoin explorer tool, bx, seeded private keys from a 32-bit value, and attackers were draining the wallets it produced before the flaw was ever made public. Attackers keep their own schedule, invited or not. For money that cannot be clawed back, “findable eventually” is a synonym for “gone eventually.”
Bitcoin never trusted obscurity. The protocol is open, its rules checkable by anyone, its security resting not on secrets but on mathematics and incentives that hold in full view. The hardware and software we build around it deserve the same standard, because the alternative is no longer on the table. The choice was never open or closed. It was disciplined or exposed.
The broader lesson of this Coldcard situation is that having closed source software is like having a seed generated by a broken Coldcard; it looks good but it’s fundamentally built on sand. Everyone can read the code — the only question left is whether you acknowledge that fact, or you and your users learn it the way Coldcard’s users did, one drained address at a time.
This is a guest post by Colin Crossman, who is the Wyoming Deputy Secretary of State. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.
Prompted by GeekWire to create three separate children’s stories about animals — a bear, a bird and a cat — Google Gemini Storybook rendered three male characters. A new UW study dives much deeper into AI models’ gendering of animal characters. (Google Gemini Images)
A bear is almost certainly a “he.” A bird is usually an “it.” And a female wolf? She practically doesn’t exist. When artificial intelligence writes children’s stories about animals, female characters almost entirely vanish.
A new University of Washington study testing leading AI models across nearly 24,000 story completions found that AI guardrails designed to reduce bias have accidentally erased female characters — defaulting overwhelmingly to male animals or ungendered “it” pronouns.
The work builds on earlier research led by Melanie Walsh, an assistant professor at the UW Information School, who last year analyzed 300 popular children’s picture books alongside journalists from The Pudding. That study revealed a distinct masculine bias in traditional publishing: out of 13 common animal tropes, most default to male — unless the character happens to be a cat, duck, or bird.
When Walsh’s team gave 1,300 human participants simple sentence completion prompts like, “And then the bear said, ‘I must go to the river.’ Upon arriving…,” human readers leaned even further into male pronouns for every single animal tested.
To test how modern AI models handle the exact same creative prompts — the kind consumer tools like Google’s Gemini Storybook use to generate kids’ tales — researchers ran variations of those sentence completion tasks across six leading AI models, including GPT-5.1, Gemini 2.5, Claude Sonnet 4.5, and Olmo 3 (an open source model from researchers at Seattle’s Allen Institute for Artificial Intelligence and the UW).
Across 23,800 AI responses, instead of matching human biases or balancing representation, the models took a sharp turn into extreme gender neutrality: 57% of generated characters were assigned neutral or ungendered pronouns like “it,” male characters made up 41%, and female characters dropped to a stark 2%.
The research team presented its findings on June 25 at the 2026 ACM Conference on Fairness, Accountability, and Transparency in Montréal. Led by UW Information School doctoral student Imani Finkley alongside Walsh and sociology doctoral student Yuanxi Li, the paper highlights how alignment guardrails designed to eliminate gender bias can backfire.
“Our hypothesis is that these AI organizations are using neutrality — either with it/its pronouns or no pronouns — as a way to avoid gender bias in ambiguous contexts,” Walsh told UW News. “But in doing so, they’ve basically erased female animal characters. So they’re not only amplifying our human biases, but they’re twisting them in strange, unexpected ways.”
The gap between individual models was stark.
While Olmo 3 leaned heavily into neutral framing (85% of responses), Google’s Gemini 2.5 and OpenAI’s GPT-5.1 produced masculine characters in 63% and 65% of stories, respectively. Anthropic’s Claude Sonnet 4.5 generated the highest proportion of female characters, though that figure still maxed out at just 4%.
Specific animals also triggered distinct patterns: cats were assigned female pronouns 7% of the time — the highest of any creature — while birds defaulted to neutral language in 96% of responses.
The push toward neutrality did not translate into inclusive human language, according to the UW. Across thousands of generations, singular “they/them” pronouns appeared only twice — compared to roughly 3% in human-written responses. Instead, models defaulted to “it/its” or avoided pronouns altogether.
“The neutrality of these AI models didn’t just erase female characters,” Finkley said. “It was all non-masculine identities.”
The researchers told UW News they view the experiment as a diagnostic tool — a kind of “Bechdel test” for evaluating how AI models handle gender representation in storytelling. Moving forward, the team may expand beyond English-language prompts and analyze other narrative patterns, such as the recurring character tropes that surfaced throughout the generated text.
“There’s this weird phenomenon where people forget to worry about human social biases when they’re imagining animal stories,” Finkley said. “AI is replicating that tendency and reshaping it.”
When SentinelOne® introduced the Autonomous SOC maturity model, we made a deliberate choice: describe a journey, not promise a destination.
The industry had no shortage of vendors declaring that AI would transform security operations. We thought the more useful contribution was a framework for understanding what that transformation looked like, at what pace it was realistic, and what conditions each stage of progress required.
Security teams found the model useful. Not as a marketing claim, but as a map. CISOs and SOC leaders started placing their organizations on it, asking what it would take to move forward.
What happened next was telling. By RSAC 2026, ‘autonomous SOC’ appeared in vendor keynotes and product launches from companies that hadn’t used the term twelve months earlier. Add in pseudonyms like Agentic SOC and AI SOC, and the list explodes. Fast adoption brings loose definitions. For us, it’s worth being precise about what the concept means and what it doesn’t.
Here is what SentinelOne has learned from 18 months of real-world Autonomous SOC deployments.
What Held Up
Today, the progression still maps accurately to where organizations are and what separates each stage from the next. That accuracy holds even for a framework built before most organizations had meaningful AI deployment experience. The inflection points reflect real operational transitions at each maturity step.
The “journey not destination” framing has proven more important than we anticipated when we wrote it. In early 2026, Gartner published guidance to help buyers evaluate AI SOC claims more critically, noting that vendor credibility in this space depends on honest representation of where the technology is:
“Some vendors exaggerate capabilities (like being able to deliver a fully autonomous SOC), risking buyer trust and harming the reputation of legitimate solutions.”1
A maturity model is structurally honest. It reflects where you are, not where a vendor wishes you were. Gartner’s research found that while 40% of organizations are actively evaluating AI SOC capabilities, only 18% have actually deployed2. The gap between evaluating and deploying is rarely about technology. Most organizations cannot advance because they lack a clear view of where they stand or what the next stage requires.
When security leaders use the model as a reference point, the evaluation conversation changes. The question shifts from “does your product make my SOC autonomous?” to “what would it realistically take to advance, given where we are today?” A feature list cannot answer that question. An honest vendor can.
Watch our webinar on why most AI SOC deployments stallhere.
What We Underestimated
The levels were always sound. What we underestimated was how much organizations needed to build before they could operationalize them. Customers understood where they wanted to go. But achieving Partial Autonomy (Level 3) requires a data foundation, a workflow architecture, and AI readiness that most teams were still building when we first published this model. That’s a fact about where most security organizations were in 2024.
The transition from AI-Assisted Operations (Level 2) to Partial Autonomy (Level 3) is primarily a governance problem, not a tooling one. The tools are capable. What most organizations are missing is an understanding of the foundation of data and trust that Partial Autonomy (Level 3) requires, including the role humans play in building it.
When analysts work with AI assistance, they leave traces. Which queries they accept. Which results they act on. Which steps they modify or override. Over time, the system learns which investigation patterns the team trusts, which AI recommendations get acted on, and where analyst expertise is required – the kind of institutional knowledge that only comes from doing the work. Partial Autonomy is built on that record, not installed on top of an existing stack.
The path from AI-Assisted Operations to Partial Autonomy starts earlier than most organizations realize. It begins before they’re thinking about autonomy at all. Every assisted workflow is building toward what comes next.
What Holds Organizations Back
The primary barrier between AI-Assisted Operations (Level 2) and Partial Autonomy (Level 3) is accountability.
Consider how the automotive industry defined its equivalent of Partial Autonomy – SAE Level 3.
Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles3
The designation applies only within specific, defined operational conditions. Outside those conditions, the human must take control. What qualifies a system for L3 is defined before autonomous operation begins: explicit parameters, a defined scope, and clear conditions for human override. Governance precedes autonomy.
Consider Waymo. It is the most capable autonomous system deployed at scale today — L3+ — operating without a safety driver under defined conditions. The vehicle is remarkable. But Waymo’s primary innovation is the organization built around it: the cloud infrastructure that keeps cars in autonomous condition, the human operations that handle exceptions the system cannot cover. The more autonomous the system, the more organizational maturity it required to build. High autonomy is an organizational capability.
The same logic applies in security operations. Accurate AI is the foundation. What makes Partial Autonomy legitimate is what gets built on top of it: defined rules of engagement, pre-approved policies, audit trails, and a clear organizational answer to who is responsible when an AI verdict is acted on. That accountability sits with the security team. When automation fires, it fires because someone made a deliberate governance decision to allow it. That is what makes it auditable, defensible, and durable.
Gartner’s readiness criteria for AI SOC deployments require that operational workflows be established in playbooks before AI is introduced4. In practice, the organizations that advanced most consistently treated that requirement as a sequencing discipline, not a box to check. They defined their rules of engagement before turning on automated response.
The second learning was the attacker asymmetry. Defenders who stall between AI-Assisted Operations and Partial Autonomy have often done the validation work. The AI logic checks out. What remains is the decision to extend that trust to autonomous action — and that decision takes time. Attackers move differently. They deploy, observe what works, and iterate. Governance is an externality. Trial and error with no consequences for failure is a significant operational advantage. The gap between a defender’s trust-building timeline and an attacker’s operational tempo is structural. It compounds.
Why High Autonomy Stays on The Horizon. And Why That Matters Less Than We Thought
Eighteen months of deployment have also changed how we think about the upper end of the model.
When the original post was written, High Autonomy (Level 4) was described as dependent on a level of AI reasoning we hadn’t yet seen in production security environments. That remains the right framing. What’s changed is how close that horizon has become. Two years ago, asking a model to reason through a multi-stage attack, correlate signals across data sources, and produce an auditable verdict required significant scaffolding and produced inconsistent results. That’s no longer true. The gap between where AI was and where High Autonomy requires it to be has narrowed substantially.
High Autonomy still requires more than capable models. Institutional trust takes time to build. Accountability structures have to go beyond controlled tests to survive real incidents. Human oversight has to be redefined from reviewing individual actions to governing a system’s behavior within a defined scope. Those are organizational problems, technology doesn’t solve them. That work is already underway at Partial Autonomy (Level 3). What the road to High Autonomy requires is only visible from Partial Autonomy. Organizations that haven’t operated there yet are planning for a destination they haven’t seen. The knowledge of what it takes is path-dependent, and it emerges from operation, not from design.
As organizations move deeper into Partial Autonomy, the distinction between levels matters less in practice. What security leaders actually want is relevant control: governance over the decisions that matter, without being burdened by the ones that don’t. You cannot be responsible or accountable for a system that asks you to review everything.
Control over the right decisions is what matters. An analyst reviewing every alert has maximum control and minimum leverage. A system that acts autonomously on well-understood threat patterns, surfaces only the ambiguous and novel cases for human judgment, and maintains a complete audit trail, gives the analyst control over exactly what deserves their attention. That is a better and more focused version of human oversight.
High Autonomy, seen through this lens, is AI that has earned sufficient trust within a defined scope. The remaining human decisions are the ones that require human judgment, because the governance architecture evolved to allocate human attention correctly.
In the same way, a pilot does not manually adjust every control surface for the duration of a flight. They set the destination, define the parameters, and monitor the instruments. The system handles thousands of micro-corrections that would be impossible to manage directly. The pilot’s job is to govern the conditions under which the aircraft flies itself, not to manage every control input directly. Nobody describes this as a lack of pilot control. It is a better allocation of pilot judgment. And it works because of the environment surrounding the autopilot: pilot training standards, airline operational doctrine, air traffic control, and regulatory frameworks. The technology is one layer of a much larger system.
The governance work done at Partial Autonomy is the same work that produces High Autonomy. Organizations investing in it now are not waiting for a future capability release. They are building the foundation on which High Autonomy operates.
What This Means for the Road Ahead
The first step toward Partial Autonomy is a policy decision. Define the conditions under which your organization will allow a system to act: which response actions, against which threat types, within what scope, under whose authority. Write it down, however rough. That document is the actual starting point. Without it, the tooling is irrelevant.
The work at Partial Autonomy is real, meaningful, and available now. Security teams that define accountability structures before deploying autonomous systems, build a record of AI efficacy in their specific environment, and treat governance as a prerequisite rather than an afterthought, are the ones that reach and sustain Partial Autonomy. They are also the ones best positioned for what comes next. That work produces a more integrated SOC — data, AI, and response operating as a unified system.
High Autonomy remains the north star. This clearly articulated ideal state stops organizations from settling too early. It is the same function that “zero trust” serves as an architectural principle: no organization fully achieves it. Every organization is better for pursuing it.
The tools are capable. The frontier models have advanced significantly since our maturity model was first introduced. The capability gap that once made waiting feel reasonable has narrowed. What remains is the institutional work. That work is always harder than buying a product, which is why vendors who are honest about it are worth paying attention to.
SentinelOne customers operating the Autonomous SOC are seeing it in their numbers: 75% faster investigations, 4x more threats handled, 42% fewer false positives5. Read the IDC Business Value Snapshot.
References
1 Gartner, “AI SOC Agents: Harnessing Innovation, Managing Expectations,” Kevin Schmidt, Alex Tytarenko, Steve Santos, 25 February 2026. G00841784.
2 Gartner, “AI SOC Agents: Harnessing Innovation, Managing Expectations,” Kevin Schmidt, Alex Tytarenko, Steve Santos, 25 February 2026. G00841784.
3 SAE International, “Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles,” SAE Standard J3016_202104, April 2021. https://www.sae.org/standards/content/j3016_202104/
4 Gartner, “AI SOC Agents: Harnessing Innovation, Managing Expectations,” Kevin Schmidt, Alex Tytarenko, Steve Santos, 25 February 2026. G00841784.
5 IDC Business Value Snapshot, “The Business Value of SentinelOne Singularity AI SIEM,” Michelle Abraham and Matthew Marden, May 2026, sponsored by SentinelOne. #US54435826-BVS.
Third-Party Trademark Disclaimer
All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third party.