Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather.

30 years a 1 month later, it seems like an apt time to revisit John Perry Barlow’s Declaration of the Independence of Cyberspace. The poetry is amazing.

This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes.

One evening last month, my Apple Watch, iPhone, and Mac all lit up with a message prompting me to reset my password. This came out of nowhere; I hadn’t done anything to elicit it. I even had Lockdown Mode running on all my devices. It didn’t matter. Someone was spamming Apple’s legitimate password reset flow against my account—a technique Krebs documented back in 2024. I dismissed the prompts, but the stage was set.

What made the attack impressive was the next move: The scammers actually contacted Apple Support themselves, pretending to be me, and opened a real case claiming I’d lost my phone and needed to update my number. That generated a real case ID, and triggered real Apple emails to my inbox, properly signed, from Apple’s actual servers. These were legitimate; no filter on earth could have caught them.

Then “Alexander from Apple Support” called. He was calm, knowledgeable, and careful. His first moves were solid security advice: check your account, verify nothing’s changed, consider updating your password. He was so good that I actually thanked him for being excellent at his job.

That, of course, was when he moved into the next phase of the attack.

He texted me a link to review and cancel the “pending request.” The site, audit-apple.com, was a pixel-perfect Apple replica, and displayed the exact case ID from the real emails I’d just received. There was even a fake chat transcript of the scammers’ actual conversation with Apple, presented back to me as evidence of the attack against my account. At the bottom of the page was a Sign in with Apple button that he told me to use.

I started poking at the page and noticed I could enter any case ID and get the same result. Nothing was being validated. It was all theater.

“This is really good,” I told Alexander. “This is obviously phishing. So tell me about the scam.”

Silence. *Click*.

Once I’d suspected what was happening, I’d started recording the call, so I was able to save a good chunk of it, which Jamie Marsland used to make a video about the encounter. You can hear for yourself exactly how convincing “Alexander” was.

So let my almost-disaster help you avoid your own. Remember these rules.

• Don’t approve any password-reset prompts—those are the first part of the attack. Do not pass Go, just head directly to your Apple ID settings. 
• Apple will never call you first. 
• When you get an email from Apple—or, really, anyone telling you to complete a digital security measure—check the URL they’re trying to send you to. Apple Support lives on apple.com and getsupport.apple.com, nowhere else.

After all, the best protection is knowing what this looks like before it happens.

Thank you to Peter Rubin and Jamie Marsland for putting this all together.

As we announced and TechCrunch covered, my.wordpress.net has soft-launched.

What this means is you need to fundamentally shift how you think about WordPress.

From the beginning, WordPress has always been open source, giving you freedom, liberty, autonomy, and digital sovereignty. Open source is the most powerful idea of our generation.

For the past few decades, WordPress was software you got from a cloud provider or web host, such as WordPress.com, Bluehost, Hostinger, or Pressable (the currently recommended WordPress hosts). You could self-host it on a Raspberry Pi or home server, but few people did.

The experience of downloading WordPress, as my Mom did, is that it unzips a bunch of PHP and various code files onto your desktop. Very confusing!

But now, thanks to incredible advances in WebAssembly (WASM), we can spin up a web server, a database (SQLite or MariaDB), and a full WordPress installation inside your browser in about 30 seconds. Instantly. No server needed. I introduced Playground at State of the Word in 2022.

You can even use it to cross-publish apps to the web, desktop, and iOS, like Blocknotes did in 2023. You can get the latest Blocknotes at Blocknotes.org. One codebase, multiple platforms.

These WordPress Playground containers are fully composable and atomic. You can track and roll back any change. Undo for everything. Stop thinking of WordPress as just on a web host and worrying about maintenance and management, and more as a self-contained unit of open source goodness, a fun little package where you own and control the code and data and can run it however you like.

How perfect is that for AI to work with? Playground makes WordPress local, fast, and trivial to spin up multiple instances, test code changes, and save them.

Next up, we’re going to add peer-to-peer sync, version control integration, and cloud publishing so other people can access it.

I believe this will take us from millions of WordPresses in the world to billions. Hosting isn’t going away; in fact, I think demand for cloud syncing will increase drastically as we radically open up what people can build on top of WordPress.

In an AI age where it’s trivial to spin up software from scratch, consumers will have to give much more thought to brands they trust to be in it for the long term. We’ve been relentlessly iterating on WordPress since 2003. I plan to work on it the rest of my life, and there’s a broad community of hundreds of thousands, if not millions, of people who make their living on top of WordPress.

On WordPress.com we offer 100-year plans and 100-year domains, and I believe we’re one of the few companies where that’s credible. It’s led by Zander Rose, who ran the Long Now Foundation (one of my favorite non-profits) from 1997 to 2023, a quarter century.

In core WordPress, we are obsessed with backwards compatibility. You can run plugins and themes written 20 years ago on today’s WordPress. I’ve stumbled on decade-old installs, and the built-in auto-upgrade took everything to the newest version.

At Automattic, for better and worse, unlike Google, we almost never shut things down. We obsess about maintaining or redirecting permalinks. We make it easy not just to get your data in, but take it out too. We build businesses that lower churn not by locking you in (Wix famously has no export) but by making it easy for you to leave. If you love somebody, set them free.

In the next few years, there will be a Cambrian explosion of software and services. You’re going to have a lot of choices about where to put your most precious data and software. You should demand open source and bet on those who are clearly in it for the long-term.

Today, everyone gets a phone number and email when they grow up. That will expand in the future, everyone will have a domain and a WordPress. A part of the internet that you own.

Technology is best when it brings people together. Technology is best when it puts you in control, gives you ownership, digital autonomy, freedom, and liberty. That’s open source. It’s so exciting to see how AI is supercharging open source.

Join the WordPress community. It’s fun! We have cookies that don’t track you.

With the rise of GLP-1 drugs, there’s a trend that magnums are being ordered at clubs to meet minimums but left unfinished.

I think there’s a space for an ultra-high-end wellness drink at clubs. Imagine Erewhon meets Magic Mind meets Kin,  maybe with some effervescence. An elixir that comes out with sparklers but makes you feel great with nootropics not hungover. Priced at hundreds of dollars retail so thousands at a club. It could even be a cold chain, with the freshest ingredients that need to be preserved.

Let’s do some turmeric-ginger-cayenne shots and get crunk.

For a brief period, Tumblr was unavailable to the 115M+ people in the Philippines because the government had blocked it. To their credit, the Philippines CICC quickly reviewed and corrected their block after mass public outrage from the Filipino Tumblr community. Let the people tumble!

I would like to offer some free business advice to people who are considering selling something they’ve created.

First, if the buyer insists you don’t talk to any other bidders, you are being screwed. They only do this because they don’t want you to find the market-clearing price.

Do you think when Microsoft called LinkedIn and said, “We want to buy you for $26B,” they just replied, “Sure! That sounds good.”

If you’re very lucky, you get to work with a bank like Qatalyst, which says, “That’s a lovely offer, let’s see who else would be interested.”

Ask yourself why someone wants to buy you? Who else might have the same motivations? That begins a process in which a wide array of parties review the deal.

If you don’t have the connections or a bank to help you, just email the CEOs of other companies that might be interested. Say: “XYZ wants to buy me for $Y dollars. Is that something you’d also be interested in?”

Now you’re creating a market.

Remember that you’re doing this for the first time, and on the other side of the table, they’ve done dozens of deals.

It really pains me to see WordPress-adjacent companies get taken advantage of by sophisticated financial and corpdev players who strong-arm them into not shopping their deal.

A confident buyer doesn’t care if you talk to others because they know they can offer you the best deal, which usually combines money with what happens to the business after it’s sold. This is the magic of Berkshire Hathaway.

Warren Buffett doesn’t care if you talk to other bidders; in fact, he wants you to, so you see why he’s the better outcome for your business if you want to sell it.

It’s tempting to want to celebrate every time a creator sells something. Say it’s good for the community. But if they didn’t sell it through a fair process, it’s more likely they were taken advantage of, and that saddens me.

For public companies, failing to follow the process I describe above can constitute a breach of your fiduciary duty to shareholders and expose you to legal action. But there aren’t any such rules for private entities, which is why they get rolled over so often.

Not doing a full What’s In My Bag yet, but I do want to highlight I’ve been really enjoying the Sennheiser HDB 630 Wireless Over-Ear Headphones. Hat tip: Philip Kaplan aka Pud.

I’m in New Orleans for the first time in 7 years for a beautiful wedding. My Mom’s side of the family emigrated here in the 1860s, and there’s a deep comfort in the art, traditions, and weirdness of Creole culture. Good music and food are ubiquitous.

I met up with WordPresser Blake Bertuccelli-Booth to catch a set by Jason Marsalis at Snug Harbor, featuring some great originals and surprising arrangements of Maroon 5’s “This Love” and the music from the Bejeweled Butterflies game. Great artists find inspiration everywhere.

Afterward, we went to see my friend Troy, aka Trombone Shorty, at his studio. (Troy and I met when we both received the Heinz Award in 2016.) He was with Silkk the Shocker and Reggie Nicholas Jr., working on beats and songs. Though I was there for just a short while, it was inspiring to see the act of musical creation.

A few days ago, Ed Sheeran went on the new Benny Blanco / Lil Dicky / Kristin Podcast Friends Keep Secrets. I haven’t watched the entire episode, but the twenty minutes from about 1:09 to the end where Ed and Benny come up with a new song I’ve seen 4 times now, it’s magical. Check it out, it’s one of the coolest things you’ll see this week.

I’ve seen Ed Sheeran loop his songs live, but this act of creation is very special, and I love the dynamic between him and Benny. It reminds me of that magical moment in Peter Jackson’s Get Back documentary where you see Paul McCartney and the band come up with the idea for the classic song Get Back.

Very excited to share that the Clay.earth team that joined Automattic last year is re-launching under a new, very cool name and brand: Mesh. Imagine something that joins you (me) to everyone you’re connected to. It’s going to be a very important layer of the distributed identity and social work we’re doing. It’s an amazing app you should try out if you haven’t yet. Available on the web, MacOS, Windows, iOS, and even the Vision Pro. Stunning design.

Tonight, a project very near and dear to my heart, the Bay Lights in San Francisco, are officially re-lighting after a three-year hiatus. It’s been an incredible journey getting here. I literally mortgaged my apartment in 2013 to help fund them the first time around, and it’s such an honor to see them relit now with better technology and new programming from the amazing artist Leo Villareal.

Whether you’re looking down at the lights from a penthouse or top office, or up at them from the water along the Embarcadero, this is truly an art project that illuminates the soul of everyone in San Francisco, radically accessible and open.

I’ve heard they’re still raising around 500k to close out the project. You can dedicate a light here for someone special. I’m going to do one to honor my father, who passed in 2016. If you’d like to be part of San Francisco’s boom loop and have a pleasant twinkle of enlightenment every time you see the bridge, I encourage you to donate as well!

If you live somewhere with a view of the bridge, think of it as buying a piece of art you’ll enjoy every night, and also having that warm feeling of being part of making San Francisco more beautiful for everyone.

I’m on the board of Illuminate, which only has two full-time employees, and I’ve never seen another non-profit generate so much public joy and benefit with so few people. They’re also behind the Golden Mile and the live music at the Golden Gate Bandshell.

Please consider making a one-time donation of a light, which is anywhere from $100 to $2,500, or become a recurring member of the Illuminate Tribe, or if you are really part of making San Francisco better consider being an Illuminary at 50k/yr.

Also, thank you to all the WordPress community members who have done so much to support this project and help them fundraise and improve their website. It’s such a great example of the WordPress open source spirit and ethos.

San Francisco is so back! Let’s go!

Long-time WordPresser Miriam Schwab just rebuilt her WordPress site with Claude Code and it looks amazing. Go check it out, this is what is possible now with proper prompting. I’d love to see a WordCamp keynote from Miriam on her process in this. (And she’s doing this while missiles are flying overhead. Wow.)

Update: She blogged a bit about the process.

If you host your WordPress on WordPress.com your AI agent can now manage your entire site, including updating posts or pages, making drafts, pretty much all the things you normally do with WordPress. Hook this up to your OpenClaw, Hermes, ChatGPT, Claude, Grok, whatever and have fun!

It’s bad, but it’s so good. As you read this deep dive into the LiteLLM backdoor hack, or this one, it’s really just quite impressive. The use of ICP canisters, wow. Just as an engineer, I’d love to meet the minds behind this code.

I’m in NYC for the Stephan Wolfram dev/ai/nyc conversation tomorrow at the Automattic Noho space. While walking back from the Apple Store in Soho where I had picked up a new Studio Display XDR to try out, ran into one of my favorite YouTube accounts to follow right now, Ari at Home! I ran into him around 32 minutes into this Twitch stream. Here’s how he set up his rig.

A video I’ve shared with friends recently is when Harry Mack ran into Ari, which was fun for me because they’re two of my favorite accounts to follow. Sorry I didn’t freestyle! I had to get back to do some work, which is why I got the monitor.

In other cool X/Twitter news, they launched an awesome feature today that lets you restrict replies not just to people you follow, but to people they follow as well. Nikita gave a hat tip to the conversation I had with Peter Levels / @levelsio.

Nobody is arguing that Stockfish is conscious, but Stockfish would kick Claude’s ass at chess.

Kevin Lincoln in AI Perfected Chess. Humans Made It Unpredictable Again.

First, I want to say how great the jazz scene is in New York. I caught a little Latin at my go-to Guantanamera last night, but the band seemed to be phoning it in a bit, so I walked over to Dizzy’s and heard an amazing big band performance by the Diva all-women Jass Orchestra, they had Clint Holmes leading vocals and I got Frank Sinatra / Count Basie vibes, so great to see such a tight big band.

In WordPress, last week it was fun to see the company some call parasitic WP Engine acquire WPackagist. So a popular way to use WordPress with Composer, previously maintained by an awesome co-op agency in London, was now in the clutches of a company using its capital advantage to try to openwash its alleged bad behavior, probably in a process that wasn’t ideal for the sellers.

Four days later, an awesome independent organization roots.io released WP Composer (renamed to WP Packages, in OpenClaw fashion) with 17x faster cold resolves than WPackagist. Check out their comparison page.

It’s beautiful to see how resilient and nimble the antibodies in the WordPress community are. Major hat tip to Ben Word.

In another type of antibody, Sid Sijbrandi, whom I previously talked about going into founder mode on his cancer, gave an incredible presentation at the Open AI Forum about how he ran a bunch of N-of-1 experiments and therapies to cure his terminal osteosarcoma. He’s also open-sourced 25TB of his data for cancer research. Incredible!

If you want to see the future of health care, give Sid’s presentation a watch.

Since he spoke to Dean Baquet in 2017, JAŸ-Z hasn’t done an interview. Hov’s back! He sat down with GQ, and it’s a lovely listen and read.

We played enough defense, 2026 is all about offense.

Your morality defines who you are, not what you’ve attained.

I’m really excited to introduce a project I worked on with various AI agents the other night, which I think represents a new way we might build things in the future.

First, the problem: My WordPress site has 5,600+ posts going back decades, and I had some categories that were old and I didn’t really use anymore, and I wasn’t happy with the structure. Every time I made a new post, it irked me a little, and I had this long-standing itch to go back and clean up all my categories, but I knew it was going to be a slog.

Let me present Taxonomist, a new open-source tool you can run with one copy-and-paste command line that solves this problem. Here’s the idea:

1. You run this code in your terminal, and it spins up a Claude Code instance that asks you for your URL.
2. Then it takes that and figures out what type of site you have, which APIs are available, and starts downloading all your posts locally for analysis.
3. Sub-agents analyze every post against your current categories and thinks about suggesting new ones.
4. It previews all the changes.
5. Tries a variety of ways to authenticate against your site and make all the changes.
6. Logs everything locally, so anything is reversible later.

THIS IS VERY ALPHA. PROBABLY BUGGY. BE CAREFUL WITH IT. PATCHES WELCOME. MAYBE MAKE A BACKUP OF YOUR SITE BEFORE YOU CHANGE IT.

It kind of just worked. I ran it live against ma.tt and it cleaned up a ton of stuff pretty much exactly how I wanted. But there’s a lot of weird stuff happening here, so I don’t know quite what this is yet.

1. It’s very non-deterministic! There is some pre-written code, and probably could be more, but a lot of the code is generated on the fly by your agent. This creates interesting bugs where people testing with less powerful models had some odd behavior.
2. I kind of want a directory of these useful AI agents on WordPress.org, but also, there’s something a little strange about trusting a remote shell script to run on your machine.
3. I tested this with Claude, but there’s no reason Codex couldn’t use the repo in the exact same way, and I’d love to improve the quick start script to start by detecting all the agents you have, asking which you’d like to use, and also which directory you’d like to work in. I think we could kill the cd taxonomist-main && claude "start" part of it.
4. Because much of the code and commands are generated on the fly from prompts, it’s very resilient! I’ve seen people try it, and it ran into errors with libraries or whatever, but it just figured out how to work around them.
5. I’d love it if, at the end of every session, there was a moment for self-reflection where the agent would take the repository and suggest upstream issues and PRs based on anything that went wrong. Then this could recursively self-improve very quickly.
6. There are some obvious improvements to this, for example, doing this for tags. Sometimes it creates too many categories when you might only want 3-5 for your theme.
7. One fun thing is a bunch of the work of this just uses public WordPress APIs, so you can run it against any site! I like using distributed.blog as a demo. It’ll still do all the fun downloading and analysis and everything, you just won’t be able to make changes.
8. I now have a local cache of all my WordPress posts I can do other interesting things with, and that’s cool.
9. The logging and reverting probably still has some bugs in it.
10. You can riff with it along the way, so for example, it suggested I get rid of my Audrey category because it didn’t have enough posts, and I asked it to look at all the companies on Audrey.co website and categorize any posts that talk about them as Audrey, which created like 50 more.
11. I want to check the GitHub repo for any updates before it starts, and maybe periodically, because it’s iterating and improving really fast.
12. It’s not the default but the entire thing is way more pleasant if you run it with skip-permissions. So testing I usually run the one-liner, exit, resume with skip.
13. You can see some of my prompt history in the Github but I apologize it’s not comprehensive, I also used Gemini and Codex with this and got lots of value from them.

So, not sure what this is, but please check it out, play with it, submit improvements or ideas, and think about what’s next. Might host a Zoom or something to brainstorm.

The final thing I say is that this was a very different process of writing software for me. Instead of staying at the computer the entire time, I found myself going away for a bit, napping and dreaming about the code, coming back with new ideas and riffing on them. Maybe I’ll return to my Uberman polyphasic sleep days? Nap-driven development?

BTW I have lots of thoughts and feedback for Emdash but I thought this was more interesting, will try to get that out later tonight. One preview: TinyMCE is a regression; they should use Gutenberg! We designed it for other CMSes and would be fun to have some common ground to jam on.