We can finally share UI-TARS-2🥳🥳 — a native GUI agent trained with multi-turn agent RL ⚡️⚡️Key highlights (all-in-one model!): 💻Computer Use: 47.5 OSWorld · 50.6 WindowsAgentArena 📱Phone Use: 73.3 AndroidWorld 🛜Browser Use: 88.2% Online-Mind2Web 🎮Gameplay: ~60% human on 15 titles · strong on LMGame-Bench 🧑‍💻TerminalUse: 68.7 SWE-Bench · 45.3 TerminalBench 🔨Tool Use: 29.6 BrowseComp Hybrid flows: GUI clicks + terminal cmds + API calls in one trace Paper Demo

Ok, enough talking. Introducing Wiretrap: Agentic Mobile App Reverse Engineering. @teller connects to over 7000 financial institutions, providing developers with a single API to integrate against. We connect using private APIs discovered by reverse engineering their mobile apps. This is a huge engineering cost (we have to analyze every app update to check for API changes), and obtaining accounts at those banks to be able to use their apps and map out the API interactions we need for our own API clients is an operational nightmare. Both are major blockers to supporting more institutions, countries, and product types, especially ones that are not practical to obtain at every bank, e.g. student loans and mortgages. Wiretrap solves for both problems. Wiretrap intercepts network requests a mobile app makes and injects symbolic responses that allow an agent to discover the underlying API contract by simply observing what the app does with them. It can override individual values to trigger different flows, allowing agents to completely map out an entire API without a single request hitting the bank. Check out this brief video of an agent using phony credentials to log into Chase (the request is intercepted by Wiretrap and never hits Chase's API) to get to the account dashboard. Note the symbolic value "req_058.response.body.bankingAccountOverviews[0]. businessName" displayed in the app UI, representing the request and key path the value originated from allowing the agent to join what is displayed on screen with what "went over the wire". Everything you see is inferred by observing how the app interacts with Wiretrap's symbolic responses. Another @teller world first :)

Flawed iOS Security: Client-side obfuscation If you listen uncritically to everything you read on the internet, you might think you’re slick by obfuscating your strings. That’s certainly what I thought in 2019 when I first decided to be the resident security expert and added code like this to protect my Mixpanel API keys. While it’s a little harder to read than raw strings, it’s still straightforward for a sufficiently motivated hacker to steal your keys. If you use an insecure approach such as base-64 encoding or XORing, it’s trivial to reverse engineer. Even with a decent algorithm and salt, attackers can use tools like Frida to extract your API keys from device memory at runtime. Obfuscation provides security by obscurity, but this isn’t an effective approach. No matter how good your obfuscation is, that API key will eventually be decoded and sent across the network. See the full blog post here:

PEOPLE ARE BUILDING SOME WILD STUFF WITH JEV 20 mind blowing projects worth checking out: 1. JEV-Ultrafast → browser agent 2. Fast-JEV-Compaction → context compression 3. JSON-Render → generative UI 4. Typesafe-MCP → use JEV with any client 5. JEV-MCP → judgment toolkit 6. Semdecide → CLI classifier 7. JEV-Codex-Router → model routing 8. Winnow → context garbage collection 9. JEV-Review → code review triage 10. Blink → repo navigator 11. Agent-Desktop → desktop automation 12. Typesafe-Mario → plays Super Mario 13. JEV-Drone → drone control 14. OneVOneJev → browser FPS 15. JEV-Trader → HFT market making 16. Prism → liquidity signal detection 17. Neo4Jev → knowledge graph traversal 18. JEV-Curate → training data screening 19. Canny → completion verification 20. KillMyIdea → startup idea scoring if you're using JEV, these are worth exploring pick one and start building

Made good progress on making Wiretrap economical on API pricing today, but LLMs are way too slow for UI traversal. Was about to reach for the Codex Spark model, but it was discontinued a few days ago! Tomorrow's goal: Jev for UI traversal. If it works, it will absolutely RIP 🔥

I've seen a lot of frankly dumb takes on Instinct's raise. The product is free, and the inference behind it is ludicrously expensive. For context, Anthropic's $200/month plan can cost $3-6K a month per user to service. So why raise $350M, and potentially another $1B? Because if you're giving this away, you need an enormous balance sheet. And your biggest competitor has limitless cash AND compute (Muse). Why invite-only? Partly hype. But mostly cost control. You can't let a million users onto a free, inference-heavy product overnight unless you're prepared to burn through a fortune in tokens (which Meta is doing). Instinct might win the category or it might not. But seeing a billion-dollar valuation, saying it's the next Clubhouse, and calling it a VC hype cycle without running the math is lazy analysis. But hey, that's most VCs on X 🤷‍♂️