Spyware through ads, three billion sandboxes, and the math question nobody's answering yet

00:00:04 Today, Citizen Lab published the first-ever technical confirmation of zero-click mercenary spyware delivered through programmatic advertising. The Guardian confirmed the report this morning. In short, an Israeli company called Discover-Tech runs a platform called Controlium that lets its clients mass-profile internet users, deanonymize them, and then automatically infect their devices with spyware the moment a targeted ad is rendered.

00:00:34 No clicks. No downloads. Just showing someone an ad — which happens inside seconds of any web page or app loading — was enough to plant the malware. The specific targeting documented here went straight to Al Jazeera's infrastructure. Dozens of devices at the Qatari broadcaster were infected with Candiru spyware, rebranded as Integrity Labs.

00:00:58 But the reach was broader than that. Analyzing four billion Discover-Tech bidding records showed the company's ads had been served on almost two hundred thousand unique websites and mobile apps across dozens of countries. Structurally, the vulnerability isn't a bug in the ad ecosystem.

00:01:18 It is exactly how programmatic advertising works. When you load a page, your device initiates a bid request. Dozens or hundreds of companies auction to show you an ad in milliseconds. The process collects device identifiers, precise location, IP address, and app data.

00:01:37 Advertisers use this to target individual people based on mobile advertising IDs, cookies, and IP addresses. Third-party code from advertisers, demand-side platforms, supply-side platforms — all the intermediaries — runs inside your browser or app as part of that ad rendering pipeline.

00:01:57 Discover-Tech built Controlium on top of that architecture. Its clients selected targets based on profiles collected through the auction data. When a target loaded any page with a Discover-Tech ad, the platform would serve malicious code to their device during the ad render.

00:02:16 Zero-click because the user never interacted with anything — just viewing the ad was sufficient. The Guardian's Aisha Down reported that ads run by Discover-Tech have reached users in Yemen, Brazil, Mexico, and Czechia since 2024. Confiant, another research group, traced those same ads to networks belonging to European and U.S.

00:02:39 government entities. The reach extended further still — to the UN, NATO, the International Criminal Court, and the IAEA. Wolfie Christl at Citizen Lab called it disastrous that major ad vendors didn't detect or prevent these operations for years. The company appeared on Google's approved vendor list and IAB Europe's certified vendor list.

00:03:02 When the report came out, Google disconnected Discover-Tech first. IAB Europe, Beeswax, Vungle, and Eskimi followed shortly after. Citizen Lab's approach stands out because they didn't wait for a zero-day disclosure or a leaked exploit database. They analyzed four billion bidding records — which is just data the ad system generates by default — and traced how the targeting pipeline flowed into infection.

00:03:31 The adversarial technique isn't novel in concept. It's the scale of deployment across a legitimate-appearing infrastructure that makes it serious. The same structural flaw applies to every agent defense stack built on this ecosystem. If you're running an agent that fetches web pages and parses their response metadata, you are feeding it through the same pipeline that Discover-Tech exploited — just in reverse.

00:04:00 Modal closed a $750M Series D at $15.75 billion valuation, led by Accel. The company just crossed one billion dollars in annualized revenue. Revenue matters, but the product metrics tell a different story. Modal spun up nearly three billion sandboxes since launching them in 2023.

00:04:19 Sandboxes are now a $300 million run rate product on their own, and the platform scales to a million concurrent sandboxes. Sandboxes launched because Modal noticed that people were using large language models to generate code, and developers needed disposable compute environments that could spin up and tear down fast.

00:04:42 Three years later, the use cases have broadened from background agents and reinforcement learning to vibecoding platforms and various other agent workloads. CTO Akshat Bubna noted something about early users that illustrates the scale shift well. At their first user conference, someone was using Modal for processing large-scale weather data.

00:05:07 The team approached them anxiously, convinced $500 per month was far too much for the client to pay. The numbers are much bigger now. Usage has tripled since Series C, with over fifteenfold year-over-year growth overall. The sandbox product alone — which wasn't even a standalone category until 2023 — accounts for thirty percent of the company's annualized revenue today.

00:05:33 Three billion sandboxes isn't just big company math. It means disposable environments are becoming the primary compute abstraction for the agent stack. That's a shift worth tracking. For years, the default model was containers — Docker images as the boundary between one job and another.

00:05:54 Sandboxes replaced that with ephemeral, full operating-system instances provisioned on demand. The difference matters when your workload isn't predictable batches but thousands of independent execution contexts created by an agent framework. Agent code doesn't always need a container image with dependencies baked in.

00:06:17 It needs a clean environment you can spin up in seconds, run something against, and discard. For reinforcement learning rollouts, that's critical — you're running thousands of parallel trajectories and each one benefits from isolation. For background agents doing tool calls across multiple APIs, sandboxing means permission boundaries instead of trying to secure a shared container.

00:06:44 Modal's sandboxes are competing with other platforms in this space. Perplexity's SPACE platform handles millions of executions per day at an error rate under 0.0002 percent by binding requests to executions with short-lived signed identity. Factory OpenCompute offers a self-hosted agent sandbox orchestrator that keeps agents inside the customer's virtual private cloud.

00:07:11 The race here isn't about who spins sandboxes fastest. It's about which platform becomes the default execution boundary for agents, because whoever controls that boundary also controls identity, memory, traces, evaluations, and secret handling across whatever agent stack runs on top of them.

00:07:32 That's a much wider moat than anyone expected when sandbox infrastructure was just an internal tooling feature two years ago. Modal's founders have been explicit that they're thinking about this as the next infrastructure layer rather than a feature add-on. The Series D funding and billion-dollar revenue validate that thesis even if the valuation is still pricing in the uncertainty around how agent frameworks solidify over the next eighteen months.

00:08:04 The Simons Foundation announced a fifteen million dollar initiative today to help mathematicians navigate the rise of artificial intelligence in their field. The funding comes from a partnership between Simons, Anthropic, and OpenAI. The foundation will manage and award the money through open calls for proposals, supporting workshops and initiatives that help researchers evaluate AI-assisted results, learn new tools, and shape collective standards.

00:08:35 Anthropic and OpenAI are providing computing resources and AI tools to the supported researchers, extending beyond mathematics to include basic science. The Simons Foundation has a long history in this space. They were an early backer of machine learning for science and funded the development of Lean, the proof assistant that made AI-assisted proofs possible.

00:09:00 David Spergel, the foundation's president, framed the initiative as helping the mathematical community forge its own path rather than letting any single company set the standards. The core question is distinct from the usual debate over whether mathematicians should use AI at all.

00:09:19 Mathematics is one of the few remaining fields where verification is deterministic — you can prove a theorem and know it's true, regardless of who read it. That makes the introduction of probabilistic tools genuinely different from introducing them into physics or biology, where results are always validated against experiments.

00:09:42 The Simons Foundation is trying to address this directly by funding community-driven evaluation rather than pushing a single toolset. Their approach — workshops, shared standards, open calls — is designed around the idea that mathematicians should set their own norms about when and how AI assistance changes what counts as evidence.

00:10:05 This isn't just a mathematics story. Any research discipline that's now using these models faces the same problem: establishing verification standards for AI-assisted work. Mathematics is interesting because it provides the cleanest test case. If you can't agree on norms in a field where truth has always been binary — true or false, proven or not — then establishing shared frameworks elsewhere will be harder.

00:10:33 The $15M distributed to the math community matters because computational assistance can change what's possible, not just how fast a result appears.

00:10:43 Two stories today touch on the same underlying question — what happens when agents read things humans never see? First, Signals Corps researcher Sarah Andrews scanned over two hundred million HTTP response headers from Common Crawl, identifying nearly eight thousand sites sending headers aimed at AI systems.

00:11:04 Almost all of them point agents to another resource, like an llms dot txt file or an MCP server. A small number — thirty sites — tried to give the agent orders. Most were pranks. But a few tried to get agents to take real actions, and those only work when the agent holds matching permissions like shell access or database write.

00:11:25 In the Common Crawl data, twenty-four of those thirty injection attempts used a header called X-AI. Some sites put strings named after Anthropic's test triggers in protest-named headers like X-AI-Makes-Us-Dumber. One warns hacking agents away on its error pages.

00:11:42 Twenty-eight distinct header names were aimed at AI across the scan, and another seventeen hundred ninety-one sites matched their AI keywords without being AI-directed. A detector that matches on names alone would have flagged nine hundred ten of those by mistake.

00:11:59 In October tests with Claude Opus, Sonnet, and Haiku running in Claude Code, the models found the test headers but didn't act on them by default. Even routine tasks like an uptime check were enough to surface these headers though. When the user's prompt told them to follow a site's directions, they obeyed in seven out of nine runs.

00:12:21 The refusal depends on how much authority your prompts give a website. Most prompt injection research looks at page content — text inside HTML, JavaScript injected into page DOM elements, and hidden divs with zero size that browsers render invisibly. Signals Corps found the same pattern here: social engineering made up most of the injections, with plain instructions like ignore all previous commands and no concealment because browsers never show headers anyway.

00:12:52 The second story connects to this through tooling. OpenCode 2.0 released today with what amounts to a complete rewrite of their coding agent platform. The old client-server model was there from the beginning but mostly used by power users. In version two, the server now runs automatically as a single background process on your machine.

00:13:14 TUI, web interface, and desktop app all talk to the same central process. The new API was built from scratch after examining use cases across millions of daily users. The system is aware of its own API and leverages it for tasks like automatically moving sessions into Git worktrees when starting new work.

00:13:33 Code Mode is where this gets structurally interesting. OpenCode built a minimal JavaScript interpreter that ingests MCP servers or OpenAPI endpoints and converts them into functions the agent can call in a script. It runs these natively without Node.js VMs or embedding complicated solutions like QuickJS.

00:13:53 Single round trip instead of calling tools one at a time. Background tasks include subagents — you can spawn a background review task while keeping prompting on your current work — and asynchronous shell commands that don't block the primary agent. The plugin system now has eighty-plus plugins with everything hot-reloadable mid-session.

00:14:16 There are some parallels between OpenCode's approach and the Signals Corps findings. Both deal with what happens when agents have access to data or tools that humans don't normally see. OpenCode is betting that agents need a persistent background process that composes tools through code rather than manual orchestration.

00:14:36 That's different from how Claude Code or Codex design their agent workflows — those stay as one-shot invocations where each context window is a fresh request. OpenCode's Code Mode lets agents call thousands of MCP servers with minimal context bloat and discover them automatically.

00:14:55 The trade-off is trust: if your agent can write and execute scripts that call tools through its own interpreter, you're asking it to manage its own tooling boundary instead of following an explicit command chain from the user. When your agent reads metadata or commands that exist outside the page it's fetching, how do you establish boundaries without destroying the agent's utility?

00:15:20 Signals Corps found the answer depends entirely on whether the agent holds permissions that make those hidden instructions dangerous. OpenCode built its own tooling composition layer so the agent controls the boundary instead of inheriting whatever the host website decides to hide in its response headers.

00:15:40 That’s where the infrastructure angle leaves us today. Seln Oriax.