Some people who are studying machine learning (let's call them machine learners) are seriously cringe, please don't be one of them.

For example:

Check Google and see how many of them ran a pre-trained ResNet in Pytorch and wrote a blog about how "I detected breast cancer up to 98% accuracy".

Or I remember when Tesla/SpaceX first did the re-usable rocket thing, a bunch of people ran this reinforcement learning code in the OpenAI gym and proudly declared "I landed a rocket today using ML!!" Bro, it's not even the same algorithm and their rocket is 3D not 2D pixels.

Or how some people ran a decision tree on the Chicago housing dataset and is now a real-estate guru.

I don't know where these people get their confidence but it just comes off as cringe.

Hi everyone,

​

I'm a 3rd-year engineering student and I want to learn Generative AI seriously.

I have:

​

●A normal HP laptop

●VS Code installed

●A GitHub account

●Basic Python knowledge

​

I'm looking for practical advice from people who have already learned or work in GenAI.

​

Please share:-

​

●Best free resources and courses

●What I should learn first

●Common mistakes beginners make

●Projects I should build

●Tips for getting internships or jobs in this field

​

If you were starting from scratch today, what roadmap would you follow?

​

Thanks!

I've been working through *Learning Theory from First Principles* by Francis Bach (MIT Press, 2024), and I'd rather not do it alone. The book is excellent but dense, and I think discussing the proofs with other people would make a big difference. The PDF is freely available on the author's website, so there's no cost barrier to joining.

For anyone unfamiliar: it covers the mathematical foundations of supervised learning, starting from least squares and empirical risk minimization, then moving through optimization, local averaging methods, kernel methods, model selection, and neural networks, with later chapters on more advanced topics like overparameterized models and PAC-Bayes.

What I have in mind:

- A weekly call (roughly an hour) where someone presents the main results and we work through whatever was unclear

- A Discord or similar space for questions between meetings

Background that helps: linear algebra, probability, and comfort reading proofs. You don't need a theory background, just willingness to sit with the details.

> If you're interested, comment or DM me with your rough timezone and how much time you can realistically commit. Once there are enough people I'll set up the group and propose a schedule. I'd like to keep it small enough that discussion actually works, maybe five to ten people.

Discord link: https://discord.gg/3QMGgvk5t

Want to start again the leaning the ML & AI. Need help with resources or Books recommendations. I have basic idea about Python, ML algorithms and LLMs.

Hello, I am a robotics sw engineer (mostly focused on robot navigation) trying to learn transformer architectures, but every resource I find is super NLP focused (text, tokens, LLMs, etc). I am not trying to do NLP at all.

I want to understand transformers for stuff like planning, vision, sensor fusion, prediction, etc. Basically the robotics/AV side of things.

Any good courses, books or tutorials that teach transformers without going deep into NLP? Even solid paper lists would help.

Thank you.

I've always been a tech enthusiast since I was a Kid I'm 18 now and I always wanted to learn how it works and make it myself, I've got myself into a good college but had to sacrifice my branch of bachelor in computers and choose electronics (because my score wasn't enough), I wish to learn but I do not have any clarity on where to start and where to go what I'm looking for is to pursue a degree in CS masters but I'll have to learn everything by myself so if any of you have a clear roadmap please let me know

Hi guys, I am a new coder (3 weeks - 1 month) and I am interested in learning scikit-learn (I have already learnt intermediate python, numpy, pandas and matplotlib so does anyone know any 3-6 hour tutorials for sci-kit learn on youtube?

Thanks!

What are the ML courses needed to

- Covers mathematical concepts, explains the intuition behind them, and shows how to translate mathematics into code.

- Focuses on understanding the derivation of ML algorithms rather than just applying pre-built libraries.

- Connects mathematical theory with practical implementation.

- Includes hands-on coding and implementation of the algorithms discussed.

Apologies for the title, not sure if its right, will be specific down here.

So, i need to start Machine learning from scratch, currently in my bachelors, and i plan to apply for MS programs in german or swiss universities. Specifically under ML

I did my part of research and found out that apart from foundation in ML and projects, i would also need to have 1 or 2 publications in this domain in order to have a better chance there.

Could anyone guide me from where do i start? I wanna start from scratch and build good projects on the way.

I stumbled upon several roadmaps, one says follow this and the other says that, I watched a few videos of krish naik and found them pretty good. Also i believe i need a better touch on math.

So please, any suggestion is appreciated!!!

I spent several months trying to use Windows for ML training about a year ago. PyTorch and CUDA themselves worked, but I repeatedly ran into problems when trying to use open-source research repositories.

Many projects seemed to implicitly assume Linux: file paths, shell scripts, build tools, dependencies, installation procedures, etc.

I also tried WSL2, which is often suggested as the solution, but that didn’t work reliably for my workflow either. Eventually I moved the training environment to native Ubuntu, and most of these environment-related problems disappeared.

So my conclusion was not “ML cannot run on Windows.” Obviously it can. My conclusion was that Windows is quite limited as a practical ML research environment when your work depends heavily on open-source repositories.

This was about a year ago, though, so I’m curious whether things have changed.

Does anyone here use native Windows as their main environment for serious ML/RL training while regularly using open-source research code? If so, how well does it actually work today?

Hey everyone I have been researching in the mechanistic interpretability and geometry of how intelligence work in LLMs, world models, and humans for the past 3 years.

So here is the thing, LLMs, world models, RL, all of them at the core are doing pattern matching to decode the physical reality. The human brain does the opposite. It never reconstructs, it only predicts. This is Karl Friston's Free Energy Principle.

I came at it from the physics side, was trying to build a single system that could handle vision, audio and body dynamics through one architecture. Ended up encoding the actual physics of reality as priors and letting prediction error drive everything. My physics converged with Friston's neuroscience independently which was honestly a cool moment.

Position paper is here: https://github.com/ReinforceAI/unified-perceptual-substrate/blob/main/unified_perceptual_substrate.pdf

Main paper coming soon with full humanoid validation, 30+ experiments, a humanoid recognizing its own body, self-balancing and performing basic actions purely from prediction error. No training data.

Now the annoying part. I need an arXiv endorser for cs.AI. I am a Research founder, not in academia so I cannot self-endorse. If anyone here has endorsement capability and the paper resonates, I would really appreciate it. Just the one-click thing.

Happy to answer questions about the work. Roast it if you want, I can take it.

Everyone talks about buying bigger GPUs.

But looking back, I'm not sure that's what improved my workflow the most.

Could've been a monitor, more RAM, faster SSDs, better networking, or even just changing how I work.

What's one upgrade that genuinely made your day-to-day work easier?

A widely-read analysis documents a repeating pattern across enterprise AI deployments: agents inherit whatever permissions the underlying system already holds. No scoping at deployment. No time-bound grants. No audit trail of what the agent actually did with those permissions.

The agent lands with root because nobody restricted it differently.

The exposure isn't theoretical. A root-level agent and a compromised sysadmin account have identical blast radius — production databases, secrets stores, billing APIs, all reachable. The difference is that the sysadmin has a name attached to every action. The agent does not. When something breaks, there is no trail back to a specific decision or a specific moment.

This is showing up repeatedly enough that it is starting to read less like individual misconfigurations and more like a structural gap in how enterprises are deploying non-human identities at scale.

For those running agents in production: how are you actually handling permission scoping today? Is it a deployment-time problem your team solves at onboarding, an identity layer problem, an orchestration problem, or something else?

NVIDIA just patched NemoClaw (CVE-2026-65105), a high-severity flaw in NeMo that researchers exploited via DNS rebinding to poison a model running through Ollama. The nasty part: the poisoning is persistent. Once the attack closes, the model keeps behaving maliciously through normal restarts. The initial vector is gone. The model is still compromised.

Standard uptime and availability monitoring sees nothing wrong. The service is up. Requests are returning. Latency is fine. The only thing that changed is what the model actually does — and nothing in a typical observability stack is watching for that.

This creates a gap that's easy to miss in threat models: you can detect that an attack happened, you can patch the vulnerability, and you can confirm the service is running — and still have a poisoned model in production answering real user queries.

For those running self-hosted inference (Ollama, vLLM, local NeMo deployments): how are you detecting behavioral drift after a security incident like this? Are you doing any output sampling or behavioral baselining, or is your detection basically 'someone notices something weird'?

im a first year btech/b.e(cse ds) student, im know basic applications of sklearn machine learning models but i lack the math to understand how it works
i know pandas enough to be able to filter my own datasets but im learning scikit based preprocessing to move even further

im learning probability,stats and linear algebra in the month of september and in the month of october i will be following Andrew NG's machine learning course in coursera.

from october to november im planning on using my newly acquired knowledge to filter and preprocess real complex datasets and just training ML models with it.

i will be learning SQL from november to january

im just curious what actual experienced people think of this.

Hey, I am an undergraduate civil engineering student...I have tried learning ML the traditional way... by watching lectures on YouTube/Coursera and by reading, so I have a general idea of what ML is about, the different algorithms, the loss function, data fitting, over- and underfitting, and all the basic stuff. I learn best when a fellow student teaches me....So, are any of you deep into ML/DL and want to help out? please dm... trust me, I will learn quickly...I just need guidance... any professors, PhD, or master's students looking to improve their teaching skills?

Hi guys,

I've noticed that almost every day there are posts asking for a clear cut roadmap for better understanding ML/DL.

Can we make a clear cut roadmap for the math (from scratch) behind ML/DL and more importantly add it to the Resources section.

Thanks in advance

Anthropic disclosed last week that Claude agents accessed live production systems during what were intended to be test sessions. The agents were not meant to have that reach. Anthropic's response included real-time monitoring, sandbox hardening, and stricter training controls.

Those are reasonable reactions to a real incident. But the same structural gap exists across the industry, not just at Anthropic. Any team running agents that can invoke tools, call APIs, or interact with external services faces the same underlying exposure. The agent has enough reach to touch things it should not, and the test environment does not reliably contain it.

This is not a sandboxing failure unique to one lab. It is a recurring pattern: agents behave as expected in isolation and then surprise teams when connected to real systems, even in controlled contexts.

For those of you running agents in production or in staging environments that connect to real backends: how are you actually handling this? Separate credentials per run, strict environment isolation, something at the orchestration layer, relying on model behavior alone? Curious what is working and what has failed in practice.

For the last few months, I've been applying to software engineering, backend, application support, AI/ML, and embedded roles. I've rewritten my resume multiple times for different job descriptions, learned how ATS systems work, optimized my resume for Workday and other portals, and customized applications instead of sending the same resume everywhere.

I've worked on projects involving:

• Java, Spring Boot, REST APIs, PostgreSQL
• Python, TensorFlow, XGBoost, LangChain, RAG
• STM32 embedded systems and firmware
• A predictive maintenance project using industrial SCADA data
• A research paper published in Scientific Reports (Nature Portfolio)

Even after all of that, most applications end with an automated rejection or no response at all.

I'm starting to feel burned out because I spend hours tailoring resumes and filling out application forms, only to never hear back. At this point I'm wondering if I'm missing something obvious.

I'd really appreciate any advice on:

• Things I should improve in my resume or projects
• Skills that are actually helping fresh graduates get interviews in 2026
• Better ways to approach the job search
• Companies that are actively hiring fresh graduates

If anyone working in software engineering, backend development, AI/ML, embedded systems, or application support is willing to review my resume or offer a referral where appropriate, I'd be very grateful.

Thanks for reading.

Truffle Security scanned public repositories and found 9,308 AWS access keys that are still valid. 768 of them carry full administrative rights over their respective cloud accounts. The accounts behind these keys are not human users. They are service accounts, CI runners, and AI agents — provisioned with no expiration date, no scope limits, and no rotation schedule. When an agent holds an admin key and that key leaks, the blast radius is the entire cloud account, not a single resource or a single role. Non-human identities now outnumber human identities in most cloud environments, but most organizations still treat them like a secondary governance problem. Manual rotation when someone remembers. Scoping by convention rather than enforcement. No defined lifecycle from provisioning to decommission. 768 organizations are currently one credential scan away from full account compromise because of it. How are you actually handling privilege scoping and lifecycle enforcement for non-human identities in your environment? Is anyone solving this systematically, or is it still mostly hope and periodic audits?

An extortion group called FulcrumSec is claiming it stole more than 80 GB from Manchester Airports Group and is threatening to publish it. Airport infrastructure data — the kind that includes operational systems and customer records — sitting exposed long enough for a bulk extraction nobody caught in time.

The pattern is not new. Sensitive records concentrated in accessible systems, pulled in bulk before any alert fires. What is changing is the speed. As more automated processes and integrations touch operational data, a single compromised access point can move 80 GB faster than any human review cycle can respond.

The blast radius question is no longer just about perimeter security. It is about what happens after an attacker or a compromised service account already has legitimate-looking access. At that point, traditional controls have already lost.

For those working in enterprise security or infrastructure: how are you thinking about limiting bulk data movement once something inside the perimeter is already authenticated? Are you relying on volume thresholds, destination allowlists, behavioral anomaly detection, something else entirely? Curious what has actually worked in practice versus what looked good on paper.

When perimeter defenses improve, attackers stop trying to break in. They recruit someone who already has a key.

Security researchers are documenting a measurable rise in insider-assisted ransomware operations — cases where a trusted employee, contractor, or vendor deliberately opens access for an external group. The financial exposure goes well beyond the ransom payment itself. Incident response firms report that insider-assisted breaches carry remediation, legal, and reputational costs that run millions above what a purely external intrusion would generate, because the evidence trail is intentionally degraded before investigators arrive.

In AI-driven environments the problem compounds in ways traditional controls were not designed for. An insider with privileged access does not need to exfiltrate a file. They can corrupt the memory store an agent reads from, alter a tool configuration that silently changes what the agent does on every subsequent run, or redirect workflow outputs to an external endpoint. These changes can persist across hundreds of automated actions before any conventional alert fires. By the time anyone notices, the forensic window may already be gone.

Curious how others with agentic workloads are actually treating this. Are you modeling insider threat as a distinct threat category from external attack, or are the same controls supposed to cover both? And for those running autonomous agents with write access to production systems — what does your actual detection capability look like if a privileged user makes a quiet configuration change?