May 18, 2026

11:01 AM - 1:00 PM PDT · 4 blocks

haikusonnetopusPlatypus

Executive Summary

The day centered on three themes: business finances, product development, and security research. A morning conversation with a business partner covered paying team members, tax planning with a new accountant, outstanding payments owed to Eduardo (D2), and plans to start running ads and open a business credit card. A brief testing discussion surfaced the need to validate workflow deliverables, followed by a solo work session investigating missing charter alignment and workflow functionality in the current product. The afternoon included consumption of security content about CI/CD supply chain vulnerabilities — specifically the Gemini CLI YOLO mode exploit, Team PCP's supply chain attacks, and the importance of sandboxing self-hosted runners.

Mind Map

mindmap
  root((May 18))
    Business & Finance
      Salary & Payments
        $2,000/month discussed
        Eduardo owed for D2
        Grace period needed
      Accountant Onboarding
        Tax planning concerns
        Structural recommendations
        Contracting tax gaps identified
      Growth Plans
        Start running ads
        Business credit card (10k limit)
        AI product for reuse/resell
    Product Development
      Demos Going Well
        Team is pumped
      Workflow Investigation
        Charter alignment parts missing
        Deliverable-to-workflow mapping unclear
        Possible missing code
      Testing
        Need walkthrough of test approach
    Security Research
      Gemini CLI Vulnerability
        YOLO mode allows arbitrary execution
        Malicious settings.json in PRs
        Patched in v39.1 and v40.0 Preview 3
      Team PCP Supply Chain Attacks
        CI/CD pipeline compromises
        LiteLLM, Axios, Trivy, ast-grep affected
      Self-Hosted Runner Risks
        Credential exposure
        Docker sandboxing recommended
        Run as non-root users
    Puerto Rico Trip
      Check brother's graduation overlap
      Potential write-off
      

Action Items

Financial & Accounting

Product & Engineering

Growth

Security (from research consumed)

Pipeline: haiku cleaned 4 blocks. opus synthesized the assembled transcript into structured insights.
haiku — Cleaned Transcript haiku
# Transcript: 2026-05-18

> 4 time blocks from 11:01 AM to 1:00 PM

---

### Casual chat about Puerto Rico trip
**11:01 AM - 11:20 AM PDT** | *casual*

**Microphone:**
Thank you. What? What a sign. How about you? Bye?

I need to talk to everybody there. I need to talk to... she kind of... what the week is living. I like a couple things, like, oh, we need to come out to Puerto Rico. That would be absolutely fucking awesome. Right? I thought so too.

I'll need to double check that that's not the weekend. Yeah, it didn't overlap with my brother's graduation. No, I mean... it even came to mind, but, you know, hopefully it can be something that we can write off. Anyways, yeah, so demos are coming super well.

Yeah, he made it to the meeting. And yeah, everyone's been super pumped. You in keeping to your video. Get all that started. Mm-hmm. Totally. And then I was thinking, Mm-hmm.

But right now we have like... I'm on. Turn out. I'm sure you would like to start getting good from working with her. I don't think I was like fucking super broke. They start getting paid, but I was having... We have the writing process. Yeah, I think that makes total sense.

I want you, I want this to do great things, and you know what? He is going to make us some of the problems. I'm not. As your salary and paying $2,000 a month. A month. There he is. Oh, yeah. So we can like kick into, I would love for it to be like Christmas and suddenly we all get fucked up. Right? We're not exactly there yet.

And your high five on. I just haven't deposited it. So I'll make sure that I prepare a little bit of a sheet of some other expenses before you go into the accounting just to make sure that he knows just what I was trying to say was not like, "oh, fuck up the tax planning and stuff," and like, "don't pay me because this is the..." You're saying about it. I don't want to say anything. Always say, "who wants to know, right at the end of this tunnel and getting paid."

Stuff that you're working on. On my end that still needs to get sorted out. Like, I know Eduardo, like, we gotta make that right. I need to finish up D2 and make sure he's got that. So I want to make sure that we got a little wiggle room with him to get a grace period.

I texted him this morning. Mm-hmm. Please proceed. I'll let you know so we can get out a meeting and we can kind of explain to you.

Bye. What? Um, so, uh, see if we can actually build out a real AI product, sort of reuse and resell. Through all that. This evening, within our team meeting, and just have an idea. Yes. No, talked to my accountant and he was like, "Holy shit!"

So then he's going to be working as our accountant. Thank you. Because initially he did offer like a really generous with the use of this kind of knowledge. Oh. Yeah. And I am running into similar stuff too, where I'm just like, "Holy shit, I can't believe I've been contracting for this long and I haven't been paying."

I see you, see you. Good. I think that it's going to have them help us out, at least like just organizing kind of like the structural stuff and like the best recommendations for how some... You know, I think the first couple of months is fine and we didn't really pay ourselves.

And now that we're gonna have like a consistent, we could start running ads. We could start... credit card as well, that I'll also him, there's doubt. Because I also think there's like racking up points and shit, like fucking, a 10k credit limit on this. So mean, hey, dude, she was a plan, my man. I'm comparing everything that we need to discuss. And yeah, I'll make sure to bring the energy.

A penny white, brother. What's that? Peace. Deuces.

### Testing discussion with colleague
**11:24 AM - 11:24 AM PDT** | *meeting*

**Microphone:**
Okay, now walk me through it. How the fuck do we test them?

### Solo work investigation with background noise
**11:28 AM - 12:21 PM PDT** | *work*

**Microphone:**
Fuck, adjusted. I'm not seeing anything about the charter alignment parts, and I'm not seeing anything about creating parts to be restored somehow, and a handful of other things that I need to investigate here. Thank you. I see some of this right here, but I'm not exactly sure what's actually the workflow parts or what's not in the UI to enable this sort of behavior. I think I see it. Could take a look to prevent duplicate requests. Yeah, I guess there's just this whole thing about where we've got the deliverables, and then what parts should exist within the workflow, which might be some sort of combination of one, or all, or two, to complete the task as the user would request. And it just feels like we're still missing that. And if there's just code missing, if we just failed to address this or fix this, maybe. The main... what's down? Once you're done, please. I don't know. And putting it together, a lot of people want to know, what do I do for work? I deliver.

Yeah, bye. I have a really funny story to tell you guys about this car. I bought a Toyota. The sunroof was seized shut. I took this car to three different shops, but nobody was able to fix it. But with my strength, strong will, and determination, I ripped this thing apart and fixed it myself. So it's probably the most proud thing I am about this car. Oh my god. There's a kangaroo next to my RX-7. You can manually pump air into your bolsters here. And lastly, but certainly not least, my car has been signed by [the Drift King himself, Keiichi Tsuchiyo]. Two more things I want to share with you guys about this car before I go. This little thing here is a bolster pump. Just grab it like this. Trademark green stitching. For a rundown of what's under the hood, we'll save that for another time. Oh, yeah.

See some cash, keep them dollars coming, and that's gonna make me dance, and that's gonna make me dance. What's up with that? Talk, you wanna see some ass, I wanna see [something]. I'm a novinha cavalota, me despachetou [my] career at 17 when [my] dad kicked [me] out [with] words [of] rage bait [to] cancel you, we'll cancel you. A couple days later, Jane sees your kids on the internet and is like, I'm so sorry, I shouldn't have talked down to you. I don't remember him apologizing. So regardless, he was doing different live gigs, he released a few EPs. Then in 2017, his debut studio album, Floridian, completely took over. He got three Grammy nominations and won best collaboration. Fresh out of motherfucking surgery, he still doing most [things], stepping in the air. He has a tough [attitude], you're scared of [him]. Fuck nigga, listen, I got an attitude. Confused with y'all? I might be, because at the end of the day, I ain't seeing fucking nothing. Thanks. Fast. This is your level. Never had to go push. I see all my nigga Gazi. But G had never act like [nothing]. I be solid. I'm a girl lawyer. If I ain't got shit, I got morals. Nah, every bitch I like really like me back. I ain't never swing on no nigga that won't fight. Bad gangsta. They feel they could drill something. If I ain't shit, I'm [going]. Yeah. Wow. Bitch, you're the blade on the [wall], yeah. I put a bitch on the play blade. I feel like Ricky Stiles. Bitch, I feel like Ricky Stiles outlook. Go! Bitch, you know you better make your feet blue. That [blade], the wall, I'll put a bitch on the outlook. Oh look! Baby, think she ended up on the blade? Go! What? Put up. Bitch, I feel like Ricky style. On the blade. On the blade. On the wall. I put a bitch on the... Oh, look. Looking good? Probably not, I probably wasn't. Forgot my white label, had to go white. Probably was, but [I] ran into [something]. I'm not in the streets. I'm cutting niggas off, beach. When [they] can't even speak. Quis my name and don't say it too loud, 'cause you gotta come here and you know I pop out. We turned to Coachella, hope you're gonna be out. Yo. I'm doing my big one, brothers like [I] will be postponed. Being too lame if we touch, rolling and get one of them out. 'Cause you know how these niggas been counting me out, late. I'm a cup, okay. I can't. Go again. Another nigga tweet, know what I said. Man, I don't put up hair, what's done is done, you know what? Getting hands just bad by Poppy, love land. I went loyal and stuck on my band. Let it go. So lie love because I'm back with Taliban. My friend right now bring a friend for my friend. You know what I'm saying? Outside is back to what it was, you know what I'm saying? Sayin'. Ask Pluto, bank of 21, you know what I'm sayin'. I done put up half, what's done [is done]? Ran 500 million on some burn shit. Can't even tell you what day it is. I been in Turkey so long, I love you. Can't even tell you what bitch you be staying at. Can't even tell you what day [it is]. Built on the sheet as she landed. About to come [down] the street as she standing. Montana when we were boxing, you think we went hand in hand. Molly Santana, new hand on Montana. Molly Santana, new hand on Montana. I'm out for the great to go fuck you pussy, but shout out your neighborhood. I get mentioned a lot by a bunch of people that I wish I never met. Hey. Ayy. You boys got enough. The sauce and the spear. These hoes know how I pop it for real. These hoes know how I pop it for real. Oh yeah. And my arm is [texting me like we, we, we, we. We] in Paris like 200 deep for real for my brother. Stop! Go! [I] didn't say [nothing]. Big crib, but I feel like no one's home. Will I find love or will I stay alone? Muma and they girls feel the crib. So I'm Drake and I'm keeping [his] name. I sport Nike shoes, I got a mic to use. To talk bad about you [bitches], I don't like you fools. Got an Oakland show tonight, baby, [I'm] on a bridge with a tank, lettered. I pull up early to that bitch, that bitch was yanking already. I said yank. I'm gonna finish it. Wow. Girl, you gotta look the part. Hey, it's Mr. Maker. Pipe down, there you go. Yeah, it's Mr. Popstar. That's the way it go. Now I'm [on my] bag. Must've heard about us, gotta catch him to left. Bye.

Nyanese carrot on the table, bees on the table. Sometimes I sit in a parking garage and I talk to my watcher, I talk to my whip. It's Drake, Iceman. I'm so aggrieved, and so forth.

But music fans continue to dig charitable hip hop. Twitter thinks I'm Filipino. Before we even really get into the bars, we have to say that when Drake needs now more than any other time in his career to generate excitement, that this man is truly short on ideas. We've heard this song ten to twenty times already.

Take a slow look at PRs and give a summary of the entire castle coming crashing down. For example, yeah, yeah. Thank you. Whoa.

I'm going to get to it. Thanks. Mmhmm. I'm gonna sleep. Hey.

You explicitly enabled --YOLO. But what happens if your pull request includes a malicious Gemini settings.json? Settings.json is very normal, very benign. I'm just...

These all were originally derived from some compromise of CI/CD, right? Again, it's this weird pattern where companies are using good development practices, but exploits happen. I'm not saying that attacks leveraging Aquabot service could be malicious by threat actors when they're self-hosted runners and you're using Docker or something. Go update your CI/CD workflow.

That I think you will also enjoy. We'll see you over there. Take care, goodbye.

I'm really damn bad. Okay, let's go. I got you! Let's go, Miss Paul. Oh.

**System Audio:**
A lot of people wanna know what do I do for work? I'm fine, the sunroof was seized shut. I took this car to three different shops. Nobody was able to fix it, but with my strength, I ripped this thing apart and fixed it myself. So it's probably the most proud thing I am about this car. It just started raining. Ah, there's a kangaroo next to my RX7.

Okay, I got two more things: strong will and determination. Oh my gosh, this little thing here is a bolster pump from Keichi Tsuchiya. Right here, I bought this dash cap from his shop in Japan. As you can see, the weather has taken a turn for the worst. I really wanted to give you guys a rundown of what's under the hood, but we'll save it for another video. I take you guys on a ride in this car, and I hope you guys enjoyed today's video. I love you guys. My car has been signed by the Drift King here as his trademark green stitching.

Today I'm going to show you guys what my 35-year-old BMW sounds like. This is my car by the way. Keep them dollars coming and that's gonna make me dance. You wanna see some ads? I wanna see some cash. Keep them dollars coming.

Seven years ago in pop culture history, Daniel Caesar got on the internet and dared us to cancel him, and so we did. This is Daniel Caesar. He was born in Toronto and he started pursuing his music career in seventh grade. When his dad kicked him out of the house the weekend of his high school graduation, I didn't look into this, but if you know the circumstances as to how and why that happened, I would love to know. Please leave it in the comments.

Culture rules was the first thing that comes to mind. Obviously, the entire Black community jumped on his throat for it. You can't say that, and also you're trying to rage bait us. Why would you even ask us if it's okay? You already know it's not okay.

March 19, 2019, she posts a picture to social media with a shirt that says "niggas lie a lot" and goes, "Am I allowed to wear this shirt?" Daniel Caesar was on the same page except everyone wasn't. Daniel Caesar gets on Instagram live kind of unprovoked, but he was drunk, and it's like everyone is being so mean to Azealia Banks right now. He said everyone is being very disrespectful and rude, and everyone needs to learn how to take a joke. And then he topped it all off by daring the Black community to cancel him.

Everyone in response was like, "We'll cancel you." A couple days later, Daniel Caesar gets on the internet and says, "I'm so sorry. I shouldn't have talked down to you." To my knowledge, I don't remember him apologizing for putting a cape on. He was wrong.

Seven years later, a lot of people have just moved on and continue to listen to Daniel Caesar's music. A lot of people though have never circled back to Daniel Caesar, and I honestly think that he put a huge dent in his career progress with this whole incident. In 2025, he released this album, "Sons of Spleggy," and he did an interview for the press release as well because he's still on kind of this apology tour.

In 2017, his debut studio album, "Floridian," completely took over. He got three Grammy nominations and one best collaboration award for "Gangster."

Grab a cup of pie now, never roll. That black, yeah? I'll put a bitch on the blade, on the water. I'll put a bitch on the outlet. Baby, you can let him choose. Just bring it back to school. Yeah, let him front his mood. Let him think he's smart. Yeah, make him trick it off and then break his heart. Go! It's me, tired up off them jiggers. Probably smoking it. No, I ain't thinking about no niggas looking for the bitches. Baby, bring the benches. Help me with the business. Baby, let him choose. Just bring it back. Oh, look! On the wood probably was, but the weight that it carry gotta whisper my name. A middle one. Mother. Bye. Up and think that they somebody. Shit is if we touch rolling in, get one of them out cuz you know how these niggas been counting me out, okay? Whisper my name, okay? Whisper my name and don't say it too lame, okay? You gotta whisper my name. Okay, I'm free man, turn shit up again. Yeah, couldn't touch with all my friends. Whole way down the road, I can't go again. You, I love this nigga twin, know what I'm saying? A-S-A twin, know what I'm saying? Understand, I understand, I understand. And Hendrix Bap, how popular to me? I went Saint John the Baptist on the land. I went Lori Lynn Stark on my bench. We'll be right with Taliban. I tell you about my run, you know I'm saying as Pluto Bank of 21, you know I'm saying? I don't put up half. Was done, is done. You know I'm saying? To causing come right now, bring a friend for my friend. No, I'm saying outside is better what it was. You know I'm saying? They could stand in ten toes. Oh quick saying. If they could have been it would have been, but they can. I'm saying I don't know what it was, you know I'm saying? I'm saying, I'm saying, I'm saying. They so down for me, gotta punt you. Understand, understand, understand, understand, understand. I just fucked a million off on some fan shit. She planned it but on the sheet that she landed about a condor of the street and she's standing. I got a freeze to France and sprinter. They want to play my listen to cook handle my tan. The way we can't even tell you which drug I'm also not saying anything they claim it. I ain't even tell you what it is. Can't even tell you what bitch you stand it. Can't even tell you what did it? She put it right out of 500 million awesome branch. She can't even tell you what day it is. I've been in turn so long. I love you can't even tell you what day it is. I'm also, I'm in the pills on the high and made. We was boxing, you think we went hand to hand? He talking on camera. He ain't nothing but a random. Molly Santana, new hand on Montana. With diamonds on diamonds and hammers on helmets, I'm a big shot where these hoes are from. Randas nice for your turn. Iceman Turk, what? Turnt, what else? Fuck you pussy, but shout out your neighborhood. I get mentioned a lot by a bunch of people that I wish I never met. A million dollars. It's been so long since you texted me. I finally, hey, blow on me just like some green tea, baby. Hey, hey, hey. Buried alive, someone come date me. I need to go break and I feel like I'm on ecstasy. You say teach me, baby. From Vancouver, you up. Hey, hey. You boys got these hoes know how I pop it for real. I made way too much in a week. Must be 250 at least. Like the money just grew up a tree. Like the money just came in for free forever. Yeah, never mind machine scanning my knee. Same body but two different colors. And I might just tell Kyle get another. Small prices he kept it 100. And I might book a flight out to London. Girl she just text me like we, we, we, we. We in Paris like 200 D for real. And I went by the whip for my brother. Fuck now. Outro music. So baby you need someone passionate, girl, you niggas. You need a dagger and I'm finally ready to put. Hey, it's Mr. Maker. Pipe down, there it go. Yeah, it's Mr. Popstar, that's a way it go. Now I'm too hard for the fucking radio. Yeah, too hard for the to that. Live I reckon we're back. Table B's. Sometimes I sit in a parking garage and I talk to my watcher, I talk to my whip. It's be. Drake, Iceman, I'm so aggrieved. It's made fun of and with 20. On the table, bees on the table. Can't even talk to my dogs, can't even talk to my bitch. Little bit deeper and try out other stuff and get all the on a logging to himself.

All right, but before we even really get into the bars, we have to say that at this point in 2026, and I don't know why a good portion of music Twitter and hip-hop Twitter thinks I'm Filipino, but you know, it's to think of this and you know, let's maybe be a little charitable and say this is like an old track or something like. Minimum, this song is like a out, but you know man, your only access, your only window to the outside world is the internet and those immediately in your circle who you pay to be your yes men. He's had two years to excitement. That this man is truly short on ideas. We have heard this song 10, 20 times already. Like the basic mid-paced slow stability, but it's clear at this point when Drake needs now more than any other time in his career to drum up something that will actually generate excitement. And look, don't just hate it immediately, but it is clear at this point and you know, maybe there's going to be some new stuff on Iceman that will be blown away. There's a possibility. Background pitch altered soul or R&B sample that's like, you know, a little. At PRs and give a summary of the change is actually a really good way to reduce the amount of debt that people have to deal with.

However, if you use those tools in a wrong way or if those tools have a vulnerability in real life, let me be very clear. I think that using AI to do PR code review is actually a very good thing. Using AI-assisted tooling to look at pull requests that somebody submits is again a good thing. At the end of the day, you have to be using the Gemini CLI or the run Gemini CLI workflow that already exists. The problem with these tools is that to use them in a headless mode, to use them in a way that you can use in a CI/CD deployment, they have to run in YOLO mode.

YOLO mode is literally the mode that allows you to run arbitrary commands on the system with the --YOLO flag. But what happens if your pull request includes a malicious settings.json? Settings.json is a very normal, benign JSON configuration. By design, when you're doing Gemini CLI in CI/CD, it has to run this way so that the CLI can run arbitrary tooling. This is fine if you explicitly enable and configure your agent. You can enter VIM mode. Maybe you want to use the GitHub theme because you hate yourself. Maybe you want to run a set of tools inside the Docker sandbox. The tools option allows you to run in a sandbox—that's incredible.

But in classic tooling fashion, there is a hook. The hook comes in a variety of forms. One is "before_tool," but the other is "before_agent," which means after the user submits the prompt but before planning, before any AI agent is run, it will run a before_agent hook. That hook can be a command. It could be a command named "security_check" that arbitrarily runs any command on the system. Again, this is fine if you as the author of the code are the one authoring the command. But here's the big issue.

When you do a pull request, guess who can do it? Who controls the code? You potentially, but more importantly, the hacker, the evil person is in charge of the code. So what could happen here—before they fixed this vulnerability—is a hacker could submit a malicious pull request and then a GitHub workflow would fire. Again, this is literally just Red Hat as an example. They didn't get hacked. I'm just showing you that workflows like this do exist.

You can submit a pull request. The pull request workflow, the Gemini PR review, will run. This is a pull request target if they get opened, so it'll run on open. Then you will fire the PR review using Gemini. But the issue is that up until this was patched, you were able to run any arbitrary commands within the context of settings.json, which would run inside of the CI/CD runner as the organization. This means that by getting arbitrary code execution inside of the CI/CD runner, you can potentially extract their tokens, their API keys, anything that was living inside of the environment that your payload was running in.

Now let's talk about Team PCP. If you're not aware, Team PCP is the threat actor behind a majority of the large-scale supply chain attacks that have been happening for the last couple of months. These were all originally derived from some compromise of CI/CD pipelines. Again, it's this weird pattern where companies are using good development tooling. These include LiteLLM, TriviTools, the Chexmarks tool—which is a software composition analysis and security tool—and apparently Telnix, another tool I haven't heard of. Good security practices exist, but because they're using these tools with a bad assumption about how they're being used, it's causing huge downstream effects. I'm not saying this is enabling actors to do this kind of compromise. Again, all of these hacks have something to do with a compromised CI/CD pipeline. The workflow compromise happened because Axios used the Chexmarks tool under the hood.

In March of this year, Team PCP leveraged an attack that took advantage of an Aqua Bot service that allowed them to compromise the CI/CD action. The Trivy action got compromised, which caused the LiteLLM compromise, for example. Also the Axios compromise came from the compromise of the Axios Trivy Action Repository. Following that, also in March, Aqua Security's Trivy, which was compromised by Team PCP, had a vulnerability in their GitHub Action that allowed them to compromise ast-grep, which eventually led to downstream effects.

Now it's very important to highlight that the way CI/CD works under the hood is when a payload is being run by CI/CD, there has to be a runner that runs it. A lot of the runners are run by GitHub—by default, when you run a workflow in GitHub, it is a GitHub-hosted runner for you. But it's also very common for large companies to run a self-hosted runner. The payload will get picked up by a local binary on your infrastructure, and it'll pull it down and run the workflow on your behalf. This is a very common thing to do.

Now, the issue with this is if you design your workflow around the assumption that the code running in your runners is trusted and don't exercise proper caution, when a bug like the Gemini CLI vulnerability gets exploited, they now have code execution in your runner. If you don't properly protect sensitive data inside of those runners, you're going to have a bad time. Your API keys could be picked up. Your environment variables for other processes that are at the same privilege level could contain database credentials or API credentials and could also get compromised.

For those of you watching this video, you may be asking what do I do about this, right?

What do I do with this pattern of supply chain getting attacked in Gemini CLI and potentially other tools being used in this way that could be malicious? What you're doing is going to lead to a compromise in some capacity. And as a result, if someone were to land in a place like your local GitHub runner, or if someone were to land in your pull request environment that is maybe cloud hosted, how could that lead to a further compromise?

Like, if you're running a self-hosted runner, do you expose any services or credentials that they could access and steal? Also, use proper sandboxing. I'm hoping that if you're doing self-hosted runners, you're also using Docker or something similar that prevents compromised processes from accessing credentials and other resources that run at the same level as that runner. If that's the case, use the Linux user scheme, use the Linux permission model, and create new users for those processes so that a compromise can't escape beyond the root jail that Docker sets up.

Now, if you're running Docker containers as root, that's a whole other conversation that we should have about you not doing that in the future. That's where this goes, right?

Pretend that everything is compromised. If something gets compromised, what are you gonna do about it?

Also worth noting that Google did submit mitigations for this. So I think what happened is they made a new flag where Gemini Trust Workspace is not enabled by default. So if your workspace genuinely does run only on PRs from trusted collaborators, you can turn on Gemini Trust Workspace—bada-bing, bada-boom—and it's all good. Otherwise, you need to use the new version of the Google GitHub Actions Run Gemini CLI workflow. In versions 39.1 and 40.0 Preview 3, it basically doesn't trust the workflow settings by default. And it's important to note that some people do pin specifically to a certain Gemini CLI version.

---

<details>
<summary>Background Noise (1 blocks)</summary>

### Background audio with ad fragments
**12:34 PM - 1:00 PM PDT** | *background-noise*

**Microphone:**
Alright, let's see. First and foremost—oh shit. You don't want it? How about your beau? You're my girl. Let's see you here. What we got cooking?

Okay, come on, just a sec. There we go. Like that, right? I'm working on, guys. Ooh, yeah, there you go. Look, yeah.

And shout out to all the sweet things from Wilhelmina who told me at the white party—Drake, I love the album. And will I be kind of a genius? Like Dipp said, they really mean it, yeah. I need compliments because lately it's just falling outs and disagreements. Industry is really evil, but I realize it's got to get a little bit. And there ain't no passes for your crib, walking all of that diss talk, kid. Don't have no discussions either.

Yeah, fuck later. Reflected, I have a copy back, but destiny's written. Five questions for who said they got billions? Don't wanna get in between, dog. I was Aiden Ross with streams before Aiden Ross had ever streamed. And your people are still waiting for a free pile of streams.

But apparently everything isn't black and white and red and green—really shut up, victory anyway, Rick. But hey, come. I got problems with people who I would've never dreamed. Like a set of keys—I'm Lebanese, free and greasy, youngest put locks on the city so niggas be shitting when they come out when it's litty.

Cheers. Twisting it. Yeah, twisting his fingers and looking at me. Twisting some shit up that I never seen. Twisting it up, I don't know what that means.

Imagine, huh. All I know is I'm going to put it in the pan. What's this called? We're gonna... We'll be right back.

I didn't want to call, I sent him a sack—none of y'all, bye.

Don't stick around in the sink. Why was TPS at my crib until you boys slid?

It is what it is. Check signing is my kink, pushing out ink. I feel like large reload. Alex Moss tryna bring me back a hundred years from now. He got my body froze.

All these niggas wanna hair tap. I did more damage off a body blown, hit you off the iPhone shit. Let me hit you off the lobby. Niggas gotta be around, heads on swivel, cause we are not alone. Better have a bag with a pipe like they came from a—hey, they came from Hell on the microphone.

The Iceman was a nice man, now I'm cold.

Way out, dip out of six, right out of six, just like it did here. I feel like a spook.

Okay, I'm sorry. Oh, okay. Organized, let's get it.

Sub-Kishan, we reached the point of the event. She's a little bit more than a bag. A short-term game like Luis Suárez. You have foreign...

**System Audio:**
Be right back. Free, free, free, Albany Marina. They, the service, 100 subpoenas. Said they really mean it. Yeah, I need compliments 'cause lately it's just falling out. Some disagreements. Industry is really evil, and I, yeah, and shout out to all the sweet things from Wilhelmina who tell me at the white party. Drake, I love the album. And, well, I mean you're kind of genius. And like drips, I done got my shit inside arenas like Gilbert Arenas.

I remember lobster ravioli up at Seraphina. I was in a dream hotel before I was in a loop like a carabiner. I face the way they paint me, but it hurts just like the Eagles. L.A., love the sound. I can play a show for a million people. Don't be surprised. You see the whole YMCA just like the Village People.

These niggas measuring their dick size in millimeters. And don't be suddenly eager to hit me up and have no discussions either. Now you gotta plan a meeting with me just like the Russian leader. And shake my fucking hand in front of other beaters. Yeah, and ain't no passes for you. Quit walking all of that diss talk, kiddo, beat it.

I'm supposed to be my brother's keeper, so don't make us hit another buzzer beater. I realize it's gotta get a little deeper, other than me talking about the way I'm flipping dough like Lil' Caesars. I'm trying to catch one of you boys stargazing in the field like little leaves.

Yeah, fuck a mission, 'cause I much rather death than submission. How can you press the ignition and let some memories of the past affect your decision? I love you 'cause of the history, but if we being real, I can never forget you. For real.

Fuck the big three anyway. There was too many chefs in the kitchen. It was a mess to begin with. And now they got a new goal and we gotta test the position.

Damn, for real, I'm sensing a theme. I'm greater than everybody like some shredded cheese. I was my best, huh? Questions for niggas. I got niggas' prize possessions. I get possessive on niggas. I'm impressing everything. I get impressive on niggas. I got problems with people who I would have never dreamed. And that's dragged the mess to begin with. And now they got a new goal and we gotta test the position.

Damn, who is this guy for real? I guess a magician. 100 million streams, vanity. People who don't want to get in between.

Dog, I was Aiden Ross with streams before Aiden Ross and Everstream. In Cali, you know what I mean. The beef was fully live. You ain't allowed, and God ain't on your team. Everyone's true colors, for real.

I'm sensing a theme. I'm greater than everybody like some shredded cheese. I was in Hazelton at the one, before I was in a loop like a set, kids, ladies. Bahamas is right next to Jordan like I'm Lebanese. And apparently, niggas' souls are for sale like the seven seas.

I gave you everything you ever need, but let me find out I got that Amex. The only ones that credit me for making y'all everything you could never be.

My sixth sense is kicking in, 'cause all I hear is people that are dead will forever be stored in my memory.

Free, free, free, free, free. I just wanna be free, free, free, free, free, ready and able.

I can't talk on my bro's case 'cause it's sticky. B and the E and the R and the G and the A and the N and the G. Yeah, twisting it.

I don't recognize none of that shit that he's throwing, but maybe where he's from they know it. All I know is the man I'm a piss. Fuck that shit, man. Twist, nigga. All I know is I'ma go ahead.

We can fly downtown, just us two, unless you know the G. I'm in a rush to. I'm twisting it up 'cause he twisting at me. I haven't seen bro in a while, but that nigga wild, I'm not in a rush to.

People keep telling me smile, but bro is on trial, there's shit to adjust to. I don't need security to ride around town. We can fly downtown, just us two, unless you know the G-way handshake. When we go to shake hands, man, can't trust you.

Pulling out the cash on camera. Waterproof iPhone case, bro, splash on camera. She wanna pop ass on camera, sweetie, you can film, just don't put on camera. They're just trying to move so racist. We gotta go beat some cases before we show faces and shut down stages.

She wanna pop ass on camera, sweetie, you can film, just don't put on camera. They're just trying to move so racist. We gotta go beat some cases before we show faces and all I do is shut down stages. My face, damn, for ages. I must be in God's good graces. If my emotions are showing, it's only 'cause I'm ahead of what they got going. I'm trying to stay laid back 'cause, you know, the high heads with me and they want to get the payback going.

I don't recognize none of that shit that he's throwing, but maybe where he's from they know it. All I know is the man I'm a piss. Fuck that shit, man. Twist. Twist, nick, yeah.

Twisting his fingers and looking at me. Twisting some shit up that I never seen. Twisting it up, I don't know what that means. Twist. I'm twisting it back 'cause he twisting at me. Twisting that R in his face like Styles and P. Twisting the M in the O in the B, the O in the C, the T in the O in the B, the E in the R in the G in the N. Yeah, twisting up 'cause he twisting at me.

Yeah. Yeah.

Is that... We're in a... This...

Gotta light the tower up for this. Yo. Okay.

The charges like COVID, they'll catch it together. I'm out, running squid. Collage, same shit. This is the Scottish home. Damn, way niggas talking by ice, must be a cell on a microphone. How you niggas go from asking for some tickets now you niggas trying to stop the show? Ironic 'cause the ice man was gotta be around ice with the sticks. I'm like a hockey coach. Niggas better have a bag with a pipe like they came from a... Bag with a pipe like they came from a Scottish... Nice, man, now out of my crib until your boy slid. It is what it is. Check signing is my king, pushing out it.

Okay. Okay. Okay. Okay. Okay.

Okay. I gave her bingo—a short game.

We got the recording from the place of the event. She wants to go on the spot. She is hot. She wears a mask, and I have an XL.

The characters are the same.

</details>
opus — Synthesis opus
The day centered on three themes: business finances, product development, and security research. A morning conversation with a business partner covered paying team members, tax planning with a new accountant, outstanding payments owed to Eduardo (D2), and plans to start running ads and open a business credit card. A brief testing discussion surfaced the need to validate workflow deliverables, followed by a solo work session investigating missing charter alignment and workflow functionality in the current product. The afternoon included consumption of security content about CI/CD supply chain vulnerabilities — specifically the Gemini CLI YOLO mode exploit, Team PCP's supply chain attacks, and the importance of sandboxing self-hosted runners.

Transcript

11:01 AM - 11:20 AM PDTMicrophone
Thank you. What? What a sign. How about you? Bye?
11:01 AM - 11:20 AM PDTMicrophone
I need to talk to everybody there. I need to talk to... she kind of... what the week is living. I like a couple things, like, oh, we need to come out to Puerto Rico. That would be absolutely fucking awesome. Right? I thought so too.
11:01 AM - 11:20 AM PDTMicrophone
I'll need to double check that that's not the weekend. Yeah, it didn't overlap with my brother's graduation. No, I mean... it even came to mind, but, you know, hopefully it can be something that we can write off. Anyways, yeah, so demos are coming super well.
11:01 AM - 11:20 AM PDTMicrophone
Yeah, he made it to the meeting. And yeah, everyone's been super pumped. You in keeping to your video. Get all that started. Mm-hmm. Totally. And then I was thinking, Mm-hmm.
11:01 AM - 11:20 AM PDTMicrophone
But right now we have like... I'm on. Turn out. I'm sure you would like to start getting good from working with her. I don't think I was like fucking super broke. They start getting paid, but I was having... We have the writing process. Yeah, I think that makes total sense.
11:01 AM - 11:20 AM PDTMicrophone
I want you, I want this to do great things, and you know what? He is going to make us some of the problems. I'm not. As your salary and paying $2,000 a month. A month. There he is. Oh, yeah. So we can like kick into, I would love for it to be like Christmas and suddenly we all get fucked up. Right? We're not exactly there yet.
11:01 AM - 11:20 AM PDTMicrophone
And your high five on. I just haven't deposited it. So I'll make sure that I prepare a little bit of a sheet of some other expenses before you go into the accounting just to make sure that he knows just what I was trying to say was not like, "oh, fuck up the tax planning and stuff," and like, "don't pay me because this is the..." You're saying about it. I don't want to say anything. Always say, "who wants to know, right at the end of this tunnel and getting paid."
11:01 AM - 11:20 AM PDTMicrophone
Stuff that you're working on. On my end that still needs to get sorted out. Like, I know Eduardo, like, we gotta make that right. I need to finish up D2 and make sure he's got that. So I want to make sure that we got a little wiggle room with him to get a grace period.
11:01 AM - 11:20 AM PDTMicrophone
I texted him this morning. Mm-hmm. Please proceed. I'll let you know so we can get out a meeting and we can kind of explain to you.
11:01 AM - 11:20 AM PDTMicrophone
Bye. What? Um, so, uh, see if we can actually build out a real AI product, sort of reuse and resell. Through all that. This evening, within our team meeting, and just have an idea. Yes. No, talked to my accountant and he was like, "Holy shit!"
11:01 AM - 11:20 AM PDTMicrophone
So then he's going to be working as our accountant. Thank you. Because initially he did offer like a really generous with the use of this kind of knowledge. Oh. Yeah. And I am running into similar stuff too, where I'm just like, "Holy shit, I can't believe I've been contracting for this long and I haven't been paying."
11:01 AM - 11:20 AM PDTMicrophone
I see you, see you. Good. I think that it's going to have them help us out, at least like just organizing kind of like the structural stuff and like the best recommendations for how some... You know, I think the first couple of months is fine and we didn't really pay ourselves.
11:01 AM - 11:20 AM PDTMicrophone
And now that we're gonna have like a consistent, we could start running ads. We could start... credit card as well, that I'll also him, there's doubt. Because I also think there's like racking up points and shit, like fucking, a 10k credit limit on this. So mean, hey, dude, she was a plan, my man. I'm comparing everything that we need to discuss. And yeah, I'll make sure to bring the energy.
11:01 AM - 11:20 AM PDTMicrophone
A penny white, brother. What's that? Peace. Deuces.
11:24 AM - 11:24 AM PDTMicrophone
Okay, now walk me through it. How the fuck do we test them?
11:28 AM - 12:21 PM PDTMicrophone
Fuck, adjusted. I'm not seeing anything about the charter alignment parts, and I'm not seeing anything about creating parts to be restored somehow, and a handful of other things that I need to investigate here. Thank you. I see some of this right here, but I'm not exactly sure what's actually the workflow parts or what's not in the UI to enable this sort of behavior. I think I see it. Could take a look to prevent duplicate requests. Yeah, I guess there's just this whole thing about where we've got the deliverables, and then what parts should exist within the workflow, which might be some sort of combination of one, or all, or two, to complete the task as the user would request. And it just feels like we're still missing that. And if there's just code missing, if we just failed to address this or fix this, maybe. The main... what's down? Once you're done, please. I don't know. And putting it together, a lot of people want to know, what do I do for work? I deliver.
11:28 AM - 12:21 PM PDTMicrophone
Yeah, bye. I have a really funny story to tell you guys about this car. I bought a Toyota. The sunroof was seized shut. I took this car to three different shops, but nobody was able to fix it. But with my strength, strong will, and determination, I ripped this thing apart and fixed it myself. So it's probably the most proud thing I am about this car. Oh my god. There's a kangaroo next to my RX-7. You can manually pump air into your bolsters here. And lastly, but certainly not least, my car has been signed by [the Drift King himself, Keiichi Tsuchiyo]. Two more things I want to share with you guys about this car before I go. This little thing here is a bolster pump. Just grab it like this. Trademark green stitching. For a rundown of what's under the hood, we'll save that for another time. Oh, yeah.
11:28 AM - 12:21 PM PDTMicrophone
See some cash, keep them dollars coming, and that's gonna make me dance, and that's gonna make me dance. What's up with that? Talk, you wanna see some ass, I wanna see [something]. I'm a novinha cavalota, me despachetou [my] career at 17 when [my] dad kicked [me] out [with] words [of] rage bait [to] cancel you, we'll cancel you. A couple days later, Jane sees your kids on the internet and is like, I'm so sorry, I shouldn't have talked down to you. I don't remember him apologizing. So regardless, he was doing different live gigs, he released a few EPs. Then in 2017, his debut studio album, Floridian, completely took over. He got three Grammy nominations and won best collaboration. Fresh out of motherfucking surgery, he still doing most [things], stepping in the air. He has a tough [attitude], you're scared of [him]. Fuck nigga, listen, I got an attitude. Confused with y'all? I might be, because at the end of the day, I ain't seeing fucking nothing. Thanks. Fast. This is your level. Never had to go push. I see all my nigga Gazi. But G had never act like [nothing]. I be solid. I'm a girl lawyer. If I ain't got shit, I got morals. Nah, every bitch I like really like me back. I ain't never swing on no nigga that won't fight. Bad gangsta. They feel they could drill something. If I ain't shit, I'm [going]. Yeah. Wow. Bitch, you're the blade on the [wall], yeah. I put a bitch on the play blade. I feel like Ricky Stiles. Bitch, I feel like Ricky Stiles outlook. Go! Bitch, you know you better make your feet blue. That [blade], the wall, I'll put a bitch on the outlook. Oh look! Baby, think she ended up on the blade? Go! What? Put up. Bitch, I feel like Ricky style. On the blade. On the blade. On the wall. I put a bitch on the... Oh, look. Looking good? Probably not, I probably wasn't. Forgot my white label, had to go white. Probably was, but [I] ran into [something]. I'm not in the streets. I'm cutting niggas off, beach. When [they] can't even speak. Quis my name and don't say it too loud, 'cause you gotta come here and you know I pop out. We turned to Coachella, hope you're gonna be out. Yo. I'm doing my big one, brothers like [I] will be postponed. Being too lame if we touch, rolling and get one of them out. 'Cause you know how these niggas been counting me out, late. I'm a cup, okay. I can't. Go again. Another nigga tweet, know what I said. Man, I don't put up hair, what's done is done, you know what? Getting hands just bad by Poppy, love land. I went loyal and stuck on my band. Let it go. So lie love because I'm back with Taliban. My friend right now bring a friend for my friend. You know what I'm saying? Outside is back to what it was, you know what I'm saying? Sayin'. Ask Pluto, bank of 21, you know what I'm sayin'. I done put up half, what's done [is done]? Ran 500 million on some burn shit. Can't even tell you what day it is. I been in Turkey so long, I love you. Can't even tell you what bitch you be staying at. Can't even tell you what day [it is]. Built on the sheet as she landed. About to come [down] the street as she standing. Montana when we were boxing, you think we went hand in hand. Molly Santana, new hand on Montana. Molly Santana, new hand on Montana. I'm out for the great to go fuck you pussy, but shout out your neighborhood. I get mentioned a lot by a bunch of people that I wish I never met. Hey. Ayy. You boys got enough. The sauce and the spear. These hoes know how I pop it for real. These hoes know how I pop it for real. Oh yeah. And my arm is [texting me like we, we, we, we. We] in Paris like 200 deep for real for my brother. Stop! Go! [I] didn't say [nothing]. Big crib, but I feel like no one's home. Will I find love or will I stay alone? Muma and they girls feel the crib. So I'm Drake and I'm keeping [his] name. I sport Nike shoes, I got a mic to use. To talk bad about you [bitches], I don't like you fools. Got an Oakland show tonight, baby, [I'm] on a bridge with a tank, lettered. I pull up early to that bitch, that bitch was yanking already. I said yank. I'm gonna finish it. Wow. Girl, you gotta look the part. Hey, it's Mr. Maker. Pipe down, there you go. Yeah, it's Mr. Popstar. That's the way it go. Now I'm [on my] bag. Must've heard about us, gotta catch him to left. Bye.
11:28 AM - 12:21 PM PDTMicrophone
Nyanese carrot on the table, bees on the table. Sometimes I sit in a parking garage and I talk to my watcher, I talk to my whip. It's Drake, Iceman. I'm so aggrieved, and so forth.
11:28 AM - 12:21 PM PDTMicrophone
But music fans continue to dig charitable hip hop. Twitter thinks I'm Filipino. Before we even really get into the bars, we have to say that when Drake needs now more than any other time in his career to generate excitement, that this man is truly short on ideas. We've heard this song ten to twenty times already.
11:28 AM - 12:21 PM PDTMicrophone
Take a slow look at PRs and give a summary of the entire castle coming crashing down. For example, yeah, yeah. Thank you. Whoa.
11:28 AM - 12:21 PM PDTMicrophone
I'm going to get to it. Thanks. Mmhmm. I'm gonna sleep. Hey.
11:28 AM - 12:21 PM PDTMicrophone
You explicitly enabled --YOLO. But what happens if your pull request includes a malicious Gemini settings.json? Settings.json is very normal, very benign. I'm just...
11:28 AM - 12:21 PM PDTMicrophone
These all were originally derived from some compromise of CI/CD, right? Again, it's this weird pattern where companies are using good development practices, but exploits happen. I'm not saying that attacks leveraging Aquabot service could be malicious by threat actors when they're self-hosted runners and you're using Docker or something. Go update your CI/CD workflow.
11:28 AM - 12:21 PM PDTMicrophone
That I think you will also enjoy. We'll see you over there. Take care, goodbye.
11:28 AM - 12:21 PM PDTMicrophone
I'm really damn bad. Okay, let's go. I got you! Let's go, Miss Paul. Oh.
11:28 AM - 12:21 PM PDTSystem Audio
A lot of people wanna know what do I do for work? I'm fine, the sunroof was seized shut. I took this car to three different shops. Nobody was able to fix it, but with my strength, I ripped this thing apart and fixed it myself. So it's probably the most proud thing I am about this car. It just started raining. Ah, there's a kangaroo next to my RX7.
11:28 AM - 12:21 PM PDTSystem Audio
Okay, I got two more things: strong will and determination. Oh my gosh, this little thing here is a bolster pump from Keichi Tsuchiya. Right here, I bought this dash cap from his shop in Japan. As you can see, the weather has taken a turn for the worst. I really wanted to give you guys a rundown of what's under the hood, but we'll save it for another video. I take you guys on a ride in this car, and I hope you guys enjoyed today's video. I love you guys. My car has been signed by the Drift King here as his trademark green stitching.
11:28 AM - 12:21 PM PDTSystem Audio
Today I'm going to show you guys what my 35-year-old BMW sounds like. This is my car by the way. Keep them dollars coming and that's gonna make me dance. You wanna see some ads? I wanna see some cash. Keep them dollars coming.
11:28 AM - 12:21 PM PDTSystem Audio
Seven years ago in pop culture history, Daniel Caesar got on the internet and dared us to cancel him, and so we did. This is Daniel Caesar. He was born in Toronto and he started pursuing his music career in seventh grade. When his dad kicked him out of the house the weekend of his high school graduation, I didn't look into this, but if you know the circumstances as to how and why that happened, I would love to know. Please leave it in the comments.
11:28 AM - 12:21 PM PDTSystem Audio
Culture rules was the first thing that comes to mind. Obviously, the entire Black community jumped on his throat for it. You can't say that, and also you're trying to rage bait us. Why would you even ask us if it's okay? You already know it's not okay.
11:28 AM - 12:21 PM PDTSystem Audio
March 19, 2019, she posts a picture to social media with a shirt that says "niggas lie a lot" and goes, "Am I allowed to wear this shirt?" Daniel Caesar was on the same page except everyone wasn't. Daniel Caesar gets on Instagram live kind of unprovoked, but he was drunk, and it's like everyone is being so mean to Azealia Banks right now. He said everyone is being very disrespectful and rude, and everyone needs to learn how to take a joke. And then he topped it all off by daring the Black community to cancel him.
11:28 AM - 12:21 PM PDTSystem Audio
Everyone in response was like, "We'll cancel you." A couple days later, Daniel Caesar gets on the internet and says, "I'm so sorry. I shouldn't have talked down to you." To my knowledge, I don't remember him apologizing for putting a cape on. He was wrong.
11:28 AM - 12:21 PM PDTSystem Audio
Seven years later, a lot of people have just moved on and continue to listen to Daniel Caesar's music. A lot of people though have never circled back to Daniel Caesar, and I honestly think that he put a huge dent in his career progress with this whole incident. In 2025, he released this album, "Sons of Spleggy," and he did an interview for the press release as well because he's still on kind of this apology tour.
11:28 AM - 12:21 PM PDTSystem Audio
In 2017, his debut studio album, "Floridian," completely took over. He got three Grammy nominations and one best collaboration award for "Gangster."
11:28 AM - 12:21 PM PDTSystem Audio
Grab a cup of pie now, never roll. That black, yeah? I'll put a bitch on the blade, on the water. I'll put a bitch on the outlet. Baby, you can let him choose. Just bring it back to school. Yeah, let him front his mood. Let him think he's smart. Yeah, make him trick it off and then break his heart. Go! It's me, tired up off them jiggers. Probably smoking it. No, I ain't thinking about no niggas looking for the bitches. Baby, bring the benches. Help me with the business. Baby, let him choose. Just bring it back. Oh, look! On the wood probably was, but the weight that it carry gotta whisper my name. A middle one. Mother. Bye. Up and think that they somebody. Shit is if we touch rolling in, get one of them out cuz you know how these niggas been counting me out, okay? Whisper my name, okay? Whisper my name and don't say it too lame, okay? You gotta whisper my name. Okay, I'm free man, turn shit up again. Yeah, couldn't touch with all my friends. Whole way down the road, I can't go again. You, I love this nigga twin, know what I'm saying? A-S-A twin, know what I'm saying? Understand, I understand, I understand. And Hendrix Bap, how popular to me? I went Saint John the Baptist on the land. I went Lori Lynn Stark on my bench. We'll be right with Taliban. I tell you about my run, you know I'm saying as Pluto Bank of 21, you know I'm saying? I don't put up half. Was done, is done. You know I'm saying? To causing come right now, bring a friend for my friend. No, I'm saying outside is better what it was. You know I'm saying? They could stand in ten toes. Oh quick saying. If they could have been it would have been, but they can. I'm saying I don't know what it was, you know I'm saying? I'm saying, I'm saying, I'm saying. They so down for me, gotta punt you. Understand, understand, understand, understand, understand. I just fucked a million off on some fan shit. She planned it but on the sheet that she landed about a condor of the street and she's standing. I got a freeze to France and sprinter. They want to play my listen to cook handle my tan. The way we can't even tell you which drug I'm also not saying anything they claim it. I ain't even tell you what it is. Can't even tell you what bitch you stand it. Can't even tell you what did it? She put it right out of 500 million awesome branch. She can't even tell you what day it is. I've been in turn so long. I love you can't even tell you what day it is. I'm also, I'm in the pills on the high and made. We was boxing, you think we went hand to hand? He talking on camera. He ain't nothing but a random. Molly Santana, new hand on Montana. With diamonds on diamonds and hammers on helmets, I'm a big shot where these hoes are from. Randas nice for your turn. Iceman Turk, what? Turnt, what else? Fuck you pussy, but shout out your neighborhood. I get mentioned a lot by a bunch of people that I wish I never met. A million dollars. It's been so long since you texted me. I finally, hey, blow on me just like some green tea, baby. Hey, hey, hey. Buried alive, someone come date me. I need to go break and I feel like I'm on ecstasy. You say teach me, baby. From Vancouver, you up. Hey, hey. You boys got these hoes know how I pop it for real. I made way too much in a week. Must be 250 at least. Like the money just grew up a tree. Like the money just came in for free forever. Yeah, never mind machine scanning my knee. Same body but two different colors. And I might just tell Kyle get another. Small prices he kept it 100. And I might book a flight out to London. Girl she just text me like we, we, we, we. We in Paris like 200 D for real. And I went by the whip for my brother. Fuck now. Outro music. So baby you need someone passionate, girl, you niggas. You need a dagger and I'm finally ready to put. Hey, it's Mr. Maker. Pipe down, there it go. Yeah, it's Mr. Popstar, that's a way it go. Now I'm too hard for the fucking radio. Yeah, too hard for the to that. Live I reckon we're back. Table B's. Sometimes I sit in a parking garage and I talk to my watcher, I talk to my whip. It's be. Drake, Iceman, I'm so aggrieved. It's made fun of and with 20. On the table, bees on the table. Can't even talk to my dogs, can't even talk to my bitch. Little bit deeper and try out other stuff and get all the on a logging to himself.
11:28 AM - 12:21 PM PDTSystem Audio
All right, but before we even really get into the bars, we have to say that at this point in 2026, and I don't know why a good portion of music Twitter and hip-hop Twitter thinks I'm Filipino, but you know, it's to think of this and you know, let's maybe be a little charitable and say this is like an old track or something like. Minimum, this song is like a out, but you know man, your only access, your only window to the outside world is the internet and those immediately in your circle who you pay to be your yes men. He's had two years to excitement. That this man is truly short on ideas. We have heard this song 10, 20 times already. Like the basic mid-paced slow stability, but it's clear at this point when Drake needs now more than any other time in his career to drum up something that will actually generate excitement. And look, don't just hate it immediately, but it is clear at this point and you know, maybe there's going to be some new stuff on Iceman that will be blown away. There's a possibility. Background pitch altered soul or R&B sample that's like, you know, a little. At PRs and give a summary of the change is actually a really good way to reduce the amount of debt that people have to deal with.
11:28 AM - 12:21 PM PDTSystem Audio
However, if you use those tools in a wrong way or if those tools have a vulnerability in real life, let me be very clear. I think that using AI to do PR code review is actually a very good thing. Using AI-assisted tooling to look at pull requests that somebody submits is again a good thing. At the end of the day, you have to be using the Gemini CLI or the run Gemini CLI workflow that already exists. The problem with these tools is that to use them in a headless mode, to use them in a way that you can use in a CI/CD deployment, they have to run in YOLO mode.
11:28 AM - 12:21 PM PDTSystem Audio
YOLO mode is literally the mode that allows you to run arbitrary commands on the system with the --YOLO flag. But what happens if your pull request includes a malicious settings.json? Settings.json is a very normal, benign JSON configuration. By design, when you're doing Gemini CLI in CI/CD, it has to run this way so that the CLI can run arbitrary tooling. This is fine if you explicitly enable and configure your agent. You can enter VIM mode. Maybe you want to use the GitHub theme because you hate yourself. Maybe you want to run a set of tools inside the Docker sandbox. The tools option allows you to run in a sandbox—that's incredible.
11:28 AM - 12:21 PM PDTSystem Audio
But in classic tooling fashion, there is a hook. The hook comes in a variety of forms. One is "before_tool," but the other is "before_agent," which means after the user submits the prompt but before planning, before any AI agent is run, it will run a before_agent hook. That hook can be a command. It could be a command named "security_check" that arbitrarily runs any command on the system. Again, this is fine if you as the author of the code are the one authoring the command. But here's the big issue.
11:28 AM - 12:21 PM PDTSystem Audio
When you do a pull request, guess who can do it? Who controls the code? You potentially, but more importantly, the hacker, the evil person is in charge of the code. So what could happen here—before they fixed this vulnerability—is a hacker could submit a malicious pull request and then a GitHub workflow would fire. Again, this is literally just Red Hat as an example. They didn't get hacked. I'm just showing you that workflows like this do exist.
11:28 AM - 12:21 PM PDTSystem Audio
You can submit a pull request. The pull request workflow, the Gemini PR review, will run. This is a pull request target if they get opened, so it'll run on open. Then you will fire the PR review using Gemini. But the issue is that up until this was patched, you were able to run any arbitrary commands within the context of settings.json, which would run inside of the CI/CD runner as the organization. This means that by getting arbitrary code execution inside of the CI/CD runner, you can potentially extract their tokens, their API keys, anything that was living inside of the environment that your payload was running in.
11:28 AM - 12:21 PM PDTSystem Audio
Now let's talk about Team PCP. If you're not aware, Team PCP is the threat actor behind a majority of the large-scale supply chain attacks that have been happening for the last couple of months. These were all originally derived from some compromise of CI/CD pipelines. Again, it's this weird pattern where companies are using good development tooling. These include LiteLLM, TriviTools, the Chexmarks tool—which is a software composition analysis and security tool—and apparently Telnix, another tool I haven't heard of. Good security practices exist, but because they're using these tools with a bad assumption about how they're being used, it's causing huge downstream effects. I'm not saying this is enabling actors to do this kind of compromise. Again, all of these hacks have something to do with a compromised CI/CD pipeline. The workflow compromise happened because Axios used the Chexmarks tool under the hood.
11:28 AM - 12:21 PM PDTSystem Audio
In March of this year, Team PCP leveraged an attack that took advantage of an Aqua Bot service that allowed them to compromise the CI/CD action. The Trivy action got compromised, which caused the LiteLLM compromise, for example. Also the Axios compromise came from the compromise of the Axios Trivy Action Repository. Following that, also in March, Aqua Security's Trivy, which was compromised by Team PCP, had a vulnerability in their GitHub Action that allowed them to compromise ast-grep, which eventually led to downstream effects.
11:28 AM - 12:21 PM PDTSystem Audio
Now it's very important to highlight that the way CI/CD works under the hood is when a payload is being run by CI/CD, there has to be a runner that runs it. A lot of the runners are run by GitHub—by default, when you run a workflow in GitHub, it is a GitHub-hosted runner for you. But it's also very common for large companies to run a self-hosted runner. The payload will get picked up by a local binary on your infrastructure, and it'll pull it down and run the workflow on your behalf. This is a very common thing to do.
11:28 AM - 12:21 PM PDTSystem Audio
Now, the issue with this is if you design your workflow around the assumption that the code running in your runners is trusted and don't exercise proper caution, when a bug like the Gemini CLI vulnerability gets exploited, they now have code execution in your runner. If you don't properly protect sensitive data inside of those runners, you're going to have a bad time. Your API keys could be picked up. Your environment variables for other processes that are at the same privilege level could contain database credentials or API credentials and could also get compromised.
11:28 AM - 12:21 PM PDTSystem Audio
For those of you watching this video, you may be asking what do I do about this, right?
11:28 AM - 12:21 PM PDTSystem Audio
What do I do with this pattern of supply chain getting attacked in Gemini CLI and potentially other tools being used in this way that could be malicious? What you're doing is going to lead to a compromise in some capacity. And as a result, if someone were to land in a place like your local GitHub runner, or if someone were to land in your pull request environment that is maybe cloud hosted, how could that lead to a further compromise?
11:28 AM - 12:21 PM PDTSystem Audio
Like, if you're running a self-hosted runner, do you expose any services or credentials that they could access and steal? Also, use proper sandboxing. I'm hoping that if you're doing self-hosted runners, you're also using Docker or something similar that prevents compromised processes from accessing credentials and other resources that run at the same level as that runner. If that's the case, use the Linux user scheme, use the Linux permission model, and create new users for those processes so that a compromise can't escape beyond the root jail that Docker sets up.
11:28 AM - 12:21 PM PDTSystem Audio
Now, if you're running Docker containers as root, that's a whole other conversation that we should have about you not doing that in the future. That's where this goes, right?
11:28 AM - 12:21 PM PDTSystem Audio
Pretend that everything is compromised. If something gets compromised, what are you gonna do about it?
11:28 AM - 12:21 PM PDTSystem Audio
Also worth noting that Google did submit mitigations for this. So I think what happened is they made a new flag where Gemini Trust Workspace is not enabled by default. So if your workspace genuinely does run only on PRs from trusted collaborators, you can turn on Gemini Trust Workspace—bada-bing, bada-boom—and it's all good. Otherwise, you need to use the new version of the Google GitHub Actions Run Gemini CLI workflow. In versions 39.1 and 40.0 Preview 3, it basically doesn't trust the workflow settings by default. And it's important to note that some people do pin specifically to a certain Gemini CLI version.
11:28 AM - 12:21 PM PDTSystem Audio
<details>
11:28 AM - 12:21 PM PDTSystem Audio
<summary>Background Noise (1 blocks)</summary>
12:34 PM - 1:00 PM PDTMicrophone
Alright, let's see. First and foremost—oh shit. You don't want it? How about your beau? You're my girl. Let's see you here. What we got cooking?
12:34 PM - 1:00 PM PDTMicrophone
Okay, come on, just a sec. There we go. Like that, right? I'm working on, guys. Ooh, yeah, there you go. Look, yeah.
12:34 PM - 1:00 PM PDTMicrophone
And shout out to all the sweet things from Wilhelmina who told me at the white party—Drake, I love the album. And will I be kind of a genius? Like Dipp said, they really mean it, yeah. I need compliments because lately it's just falling outs and disagreements. Industry is really evil, but I realize it's got to get a little bit. And there ain't no passes for your crib, walking all of that diss talk, kid. Don't have no discussions either.
12:34 PM - 1:00 PM PDTMicrophone
Yeah, fuck later. Reflected, I have a copy back, but destiny's written. Five questions for who said they got billions? Don't wanna get in between, dog. I was Aiden Ross with streams before Aiden Ross had ever streamed. And your people are still waiting for a free pile of streams.
12:34 PM - 1:00 PM PDTMicrophone
But apparently everything isn't black and white and red and green—really shut up, victory anyway, Rick. But hey, come. I got problems with people who I would've never dreamed. Like a set of keys—I'm Lebanese, free and greasy, youngest put locks on the city so niggas be shitting when they come out when it's litty.
12:34 PM - 1:00 PM PDTMicrophone
Cheers. Twisting it. Yeah, twisting his fingers and looking at me. Twisting some shit up that I never seen. Twisting it up, I don't know what that means.
12:34 PM - 1:00 PM PDTMicrophone
Imagine, huh. All I know is I'm going to put it in the pan. What's this called? We're gonna... We'll be right back.
12:34 PM - 1:00 PM PDTMicrophone
I didn't want to call, I sent him a sack—none of y'all, bye.
12:34 PM - 1:00 PM PDTMicrophone
Don't stick around in the sink. Why was TPS at my crib until you boys slid?
12:34 PM - 1:00 PM PDTMicrophone
It is what it is. Check signing is my kink, pushing out ink. I feel like large reload. Alex Moss tryna bring me back a hundred years from now. He got my body froze.
12:34 PM - 1:00 PM PDTMicrophone
All these niggas wanna hair tap. I did more damage off a body blown, hit you off the iPhone shit. Let me hit you off the lobby. Niggas gotta be around, heads on swivel, cause we are not alone. Better have a bag with a pipe like they came from a—hey, they came from Hell on the microphone.
12:34 PM - 1:00 PM PDTMicrophone
The Iceman was a nice man, now I'm cold.
12:34 PM - 1:00 PM PDTMicrophone
Way out, dip out of six, right out of six, just like it did here. I feel like a spook.
12:34 PM - 1:00 PM PDTMicrophone
Okay, I'm sorry. Oh, okay. Organized, let's get it.
12:34 PM - 1:00 PM PDTMicrophone
Sub-Kishan, we reached the point of the event. She's a little bit more than a bag. A short-term game like Luis Suárez. You have foreign...
12:34 PM - 1:00 PM PDTSystem Audio
Be right back. Free, free, free, Albany Marina. They, the service, 100 subpoenas. Said they really mean it. Yeah, I need compliments 'cause lately it's just falling out. Some disagreements. Industry is really evil, and I, yeah, and shout out to all the sweet things from Wilhelmina who tell me at the white party. Drake, I love the album. And, well, I mean you're kind of genius. And like drips, I done got my shit inside arenas like Gilbert Arenas.
12:34 PM - 1:00 PM PDTSystem Audio
I remember lobster ravioli up at Seraphina. I was in a dream hotel before I was in a loop like a carabiner. I face the way they paint me, but it hurts just like the Eagles. L.A., love the sound. I can play a show for a million people. Don't be surprised. You see the whole YMCA just like the Village People.
12:34 PM - 1:00 PM PDTSystem Audio
These niggas measuring their dick size in millimeters. And don't be suddenly eager to hit me up and have no discussions either. Now you gotta plan a meeting with me just like the Russian leader. And shake my fucking hand in front of other beaters. Yeah, and ain't no passes for you. Quit walking all of that diss talk, kiddo, beat it.
12:34 PM - 1:00 PM PDTSystem Audio
I'm supposed to be my brother's keeper, so don't make us hit another buzzer beater. I realize it's gotta get a little deeper, other than me talking about the way I'm flipping dough like Lil' Caesars. I'm trying to catch one of you boys stargazing in the field like little leaves.
12:34 PM - 1:00 PM PDTSystem Audio
Yeah, fuck a mission, 'cause I much rather death than submission. How can you press the ignition and let some memories of the past affect your decision? I love you 'cause of the history, but if we being real, I can never forget you. For real.
12:34 PM - 1:00 PM PDTSystem Audio
Fuck the big three anyway. There was too many chefs in the kitchen. It was a mess to begin with. And now they got a new goal and we gotta test the position.
12:34 PM - 1:00 PM PDTSystem Audio
Damn, for real, I'm sensing a theme. I'm greater than everybody like some shredded cheese. I was my best, huh? Questions for niggas. I got niggas' prize possessions. I get possessive on niggas. I'm impressing everything. I get impressive on niggas. I got problems with people who I would have never dreamed. And that's dragged the mess to begin with. And now they got a new goal and we gotta test the position.
12:34 PM - 1:00 PM PDTSystem Audio
Damn, who is this guy for real? I guess a magician. 100 million streams, vanity. People who don't want to get in between.
12:34 PM - 1:00 PM PDTSystem Audio
Dog, I was Aiden Ross with streams before Aiden Ross and Everstream. In Cali, you know what I mean. The beef was fully live. You ain't allowed, and God ain't on your team. Everyone's true colors, for real.
12:34 PM - 1:00 PM PDTSystem Audio
I'm sensing a theme. I'm greater than everybody like some shredded cheese. I was in Hazelton at the one, before I was in a loop like a set, kids, ladies. Bahamas is right next to Jordan like I'm Lebanese. And apparently, niggas' souls are for sale like the seven seas.
12:34 PM - 1:00 PM PDTSystem Audio
I gave you everything you ever need, but let me find out I got that Amex. The only ones that credit me for making y'all everything you could never be.
12:34 PM - 1:00 PM PDTSystem Audio
My sixth sense is kicking in, 'cause all I hear is people that are dead will forever be stored in my memory.
12:34 PM - 1:00 PM PDTSystem Audio
Free, free, free, free, free. I just wanna be free, free, free, free, free, ready and able.
12:34 PM - 1:00 PM PDTSystem Audio
I can't talk on my bro's case 'cause it's sticky. B and the E and the R and the G and the A and the N and the G. Yeah, twisting it.
12:34 PM - 1:00 PM PDTSystem Audio
I don't recognize none of that shit that he's throwing, but maybe where he's from they know it. All I know is the man I'm a piss. Fuck that shit, man. Twist, nigga. All I know is I'ma go ahead.
12:34 PM - 1:00 PM PDTSystem Audio
We can fly downtown, just us two, unless you know the G. I'm in a rush to. I'm twisting it up 'cause he twisting at me. I haven't seen bro in a while, but that nigga wild, I'm not in a rush to.
12:34 PM - 1:00 PM PDTSystem Audio
People keep telling me smile, but bro is on trial, there's shit to adjust to. I don't need security to ride around town. We can fly downtown, just us two, unless you know the G-way handshake. When we go to shake hands, man, can't trust you.
12:34 PM - 1:00 PM PDTSystem Audio
Pulling out the cash on camera. Waterproof iPhone case, bro, splash on camera. She wanna pop ass on camera, sweetie, you can film, just don't put on camera. They're just trying to move so racist. We gotta go beat some cases before we show faces and shut down stages.
12:34 PM - 1:00 PM PDTSystem Audio
She wanna pop ass on camera, sweetie, you can film, just don't put on camera. They're just trying to move so racist. We gotta go beat some cases before we show faces and all I do is shut down stages. My face, damn, for ages. I must be in God's good graces. If my emotions are showing, it's only 'cause I'm ahead of what they got going. I'm trying to stay laid back 'cause, you know, the high heads with me and they want to get the payback going.
12:34 PM - 1:00 PM PDTSystem Audio
I don't recognize none of that shit that he's throwing, but maybe where he's from they know it. All I know is the man I'm a piss. Fuck that shit, man. Twist. Twist, nick, yeah.
12:34 PM - 1:00 PM PDTSystem Audio
Twisting his fingers and looking at me. Twisting some shit up that I never seen. Twisting it up, I don't know what that means. Twist. I'm twisting it back 'cause he twisting at me. Twisting that R in his face like Styles and P. Twisting the M in the O in the B, the O in the C, the T in the O in the B, the E in the R in the G in the N. Yeah, twisting up 'cause he twisting at me.
12:34 PM - 1:00 PM PDTSystem Audio
Yeah. Yeah.
12:34 PM - 1:00 PM PDTSystem Audio
Is that... We're in a... This...
12:34 PM - 1:00 PM PDTSystem Audio
Gotta light the tower up for this. Yo. Okay.
12:34 PM - 1:00 PM PDTSystem Audio
The charges like COVID, they'll catch it together. I'm out, running squid. Collage, same shit. This is the Scottish home. Damn, way niggas talking by ice, must be a cell on a microphone. How you niggas go from asking for some tickets now you niggas trying to stop the show? Ironic 'cause the ice man was gotta be around ice with the sticks. I'm like a hockey coach. Niggas better have a bag with a pipe like they came from a... Bag with a pipe like they came from a Scottish... Nice, man, now out of my crib until your boy slid. It is what it is. Check signing is my king, pushing out it.
12:34 PM - 1:00 PM PDTSystem Audio
Okay. Okay. Okay. Okay. Okay.
12:34 PM - 1:00 PM PDTSystem Audio
Okay. I gave her bingo—a short game.
12:34 PM - 1:00 PM PDTSystem Audio
We got the recording from the place of the event. She wants to go on the spot. She is hot. She wears a mask, and I have an XL.
12:34 PM - 1:00 PM PDTSystem Audio
The characters are the same.
12:34 PM - 1:00 PM PDTSystem Audio
</details>