The Gemini API CLI (gemini-api) is an experimental preview (v0.4.x) Google released on 2026-10-19: a single Go binary that turns Gemini models, media generation, and managed agents into stateless shell commands. It is not a coding agent. Use it when your own code decides the next step, Antigravity CLI when you want an agent to plan, and the Gen AI SDK for application backends.
Cloudflare's own models come in two classes: the Clef family returns option probabilities (clef 27B, clef-flash 9B, clef-omni 30B-A3B), while Clairic returns typed values and intervals. All four bill input tokens only ($0.038–$0.24 per million) and charge nothing for output; the three Clef models ship Apache-2.0 weights, and Clairic is still a hosted preview. They beat Jev on decision benchmarks and trail it on reasoning-heavy ones.
Decision models replace an LLM's "generate some text and you write the parser" with "you list the options up front and the model returns a probability for each." After TypeSafe proposed System One on 2026-09-15, this category went from one vendor to more than a dozen: Jev 1.14, the OpenAI Decisions API, Perplexity Decider v1.2, Microsoft-Decision-1, Liquid d1-ultra, Base Labs mammoth-1, vLLM d3, StartLux, Fastino GLiDE, Celeris-1 Decision, Inception Mercury Decide, and Cloudflare Clef. The two leaderboards disagree almost completely — the community Jev Decision Index 0.4.1 crown goes to GLiDE V1.2 (71.5), while the independent Artificial Analysis Decision Index crown goes to d1-ultra (65.2) with Jev 1.14 at only 57.1. Decision models win on classification and tool selection, lose on knowledge and reasoning, and are broadly overconfident.
This is the reading entry point for the `Bug Bounty from Zero` series (parts 0–14). Each post covers one decision in plain language, backed by verifiable official sources, for readers with no security background.
Replay the control, then change one field; a status code or reflected text alone is not vulnerability proof.
A TEE is a hardware-isolated execution environment meant to keep even the machine's operator from seeing what runs inside; remote attestation lets an outsider verify which program is running in that room. WhatsApp's Private Processing uses it for AI summaries. Meta's bounty page lists code execution (including bypassing code attestation), privilege escalation and VM escape at up to $300,000 each, data leaks at $150,000 and persistence at $10,000, invitation only, with lower caps for internal-only scenarios. Trail of Bits' review found 28 issues, 8 of them high severity, which shows the hard part of TEEs is implementation detail, not the concept.
AI bounty pages mostly do not pay for what a model says (jailbreaks, hallucinations, harmful output). They pay when a model is made to act against someone else (actions and data theft through indirect prompt injection), and for ordinary bugs in the software around it. Google's AI VRP base rewards run from $100 to $20,000; OpenAI's Safety Bug Bounty ranges are $250 to $7,500 per report. Rules as read on 2026-10-14.
Google multiplies the reward by 0.8, 1 or 1.2 depending on report quality across seven dimensions, and only counts what you provided before triage; later additions usually do not change it. Write to a one-page template (title, summary, preconditions, steps, impact, fix suggestion), then estimate hourly expected value as probability x amount / hours. A bigger ceiling can still lose to a small payout once the odds are low enough. Only Resolved is guaranteed to pay; duplicates and invalid reports are common. Every probability and hour count in this post is an assumption, not a statistic.
Finish a reproducible practice report, identify your gaps, then choose a course or credential; certification does not authorize testing.
Read payouts with their product, category, threat scenario and evidence requirements; program ceilings and quality rules are not interchangeable.
Read rules through four questions: what may I test, which reward conditions apply, which actions are excluded, and how must I report? A listed asset does not authorize every method or guarantee a payout.
A browser sends a request with a method, target, headers, and sometimes cookies. The server returns a status, headers, and content. Authentication identifies a user; authorization must still check access to each order.
XSS happens when a site puts user input into a page unchanged, so another person's browser runs it as code; the fix is escaping on output. IDOR happens when a server hands over whatever id it is asked for without checking the record is yours; the fix is an ownership check on the server. Google's table puts XSS under 'execute code on the client' (C0), $10,000 base on a standard Google app, and IDOR under logic flaws (S2), priced by how sensitive the exposed data is: on the same standard Google app, $3,133.7 to $31,337.
RCE means an outsider can make someone else's machine run code. In Google's table, for a normal *.google.com app, RCE has a $75,000 base reward against $10,000 for XSS. The two beginner paths are user input glued into a shell command and deserializing untrusted data; the fixes are argument lists and JSON.
Once a program is loaded into memory, the CPU runs it by following an address that says where it is now; each function call leaves a return address on the stack, a note saying where to go back to. A small C program that prints addresses lets you check this yourself.
A buffer overflow is data written past the space set aside for it, clobbering whatever sits next door. In the demo, one extra character in a name turns is_admin from 0 into 65; the fix is a length check plus a length-limited function. Canaries, ASLR and NX are extra layers, not guarantees, and AddressSanitizer catches an overflow of a standalone array but, in my test, missed one between fields of the same struct.
A hypervisor is the software layer between hardware and several operating systems that gives each virtual machine its own isolated execution environment. MSRC's Hyper-V bounty table splits guest escapes into L1 (up to $250,000) and L2 (up to $150,000); the difference is which wall gets crossed.
CVE-2021-28476 is a bug in Hyper-V's virtual network switch driver: a guest VM sends a crafted request, the host code follows an address inside it without checking, and the host crashes. Akamai claims two scenarios, a crash and code execution, but the public PoC only shows the crash; code execution was not publicly demonstrated. CVSS 9.9, patched May 2021. On the bounty table, what was publicly shown maps to the DoS cell (up to $15,000); the L1 guest-escape cell tops out at $250,000 and needs a working RCE exploit, but without an exploit that cell still has $200,000, $100,000 and $50,000 rows.
Backprop is not new math; it computes the part of the chain rule that every layer shares exactly once. For a linear layer the forward pass multiplies by W, the backward pass multiplies by W transposed, and the weight gradient is 'input times the gradient coming back'. Gradients add at a branch, so shared parameters add their gradients too. A hand-computed update on a 2-2-1 network at the end takes the loss from 0.0175 to 0.0076.
Neither parameter count nor VC dimension explains generalization in deep nets: a network can memorize random labels to 100%, which makes the VC bound vacuous, and past the interpolation threshold test error falls a second time as parameters grow. Isola's account is that there are pressures beyond fitting the data, and he considers architectural symmetry and compositionality the most important. The question is still open.