Xiaomi put a $1M AI training run on a public webpage.

What this video covers

• Xiaomi streams the MiMo 2.6 Pro/Flash RL runs live: $5.71/s, 7 restarts, 30B tokens, DeepSWE 58 → 65.8 (its own eval)
• Neovim's footer address holds 10.89 BTC (≈ $830k); 10 BTC arrived March 2023, nothing has left since 2019
• Flock camera dumped (Wired / 404 Media / Micah Lee): Android 8.1, patch level 2018-06-05, Linux 3.18, hard-coded API key, plaintext Auth0 secrets
• Servo: one donation-funded part-time maintainer, 1,150 PRs reviewed, 8 new maintainers, 114 starter issues (92% fixed)

Transcript

0:00 Xiaomi is training its next model live on a public web page, whose counter reads one million dollars and seven restarts. In this video: the live dashboard, why it keeps crashing, Neovim's forgotten fortune, a dumped Flock camera, and Servo's year. It's Thursday, September 17th, and this is The Daily Diff. Xiaomi opened the trainer logs of MiMo 2.6 to the internet. Neovim was told it owns eight hundred thousand dollars of Bitcoin it never touched. Hackers cut down a Flock camera and read its firmware.

0:27 And Servo counted what a year of donations bought. The page is mimo dot xiaomi dot com slash R L: the trainer's own metrics for two reinforcement learning runs, MiMo 2.6 Pro, a trillion parameter model with forty two billion active, and 2.6 Flash, the small one. Both started on Tuesday; by Wednesday night Hacker News had given it four hundred and eighty points, more than most models get at release. Every step, the Pro run samples about fifteen hundred prompts,

0:55 two thirds of them code, runs sixteen attempts each in sandboxes, grades them, and trains on the result, two and a half billion tokens a step. The headline is the pass rate, the share of attempts that succeed: fifty six percent at step one, sixty one at step fourteen, the sound of a model learning, or of a very expensive dice game. Now the part no launch blog would ever show you. The Pro run has restarted seven times in fifty one hours, and the operators post the reasons: a VRAM issue on one node; a network problem

1:25 between the training cluster and the grader; and then, we removed the cyber dataset since we observed some bad patterns in the rollout logs, the most honest sentence ever published by a company selling a model. The Flash run was rolled back to step fifteen because an infra error on one dataset went undetected for three hours, which in most companies is the intern's problem and here is a public changelog entry. Meanwhile the cost counter ticks at five dollars and seventy one cents a second, about twenty thousand dollars an hour, so every restart you watch is somebody's

1:56 annual salary evaporating live. The benchmark line is the one to watch. Xiaomi hand-fills DeepSWE scores as checkpoints get evaluated, and Pro went from fifty eight to sixty five point eight in eleven steps, near the top of the coding agent leaderboards. Hacker News asked: if you grade the model on the benchmark while you train it, is that not contamination? The defence: a checkpoint check is not training data,

2:19 which is true, and also how every lab picks the checkpoint that scores highest. A slide-deck benchmark, drawn live. Two more things. The footer says Open is what we value, yet Xiaomi's own X account has not mentioned the stream; its latest post is a desktop app beta, so the most transparent training run in AI was discovered by a Hacker News user and a Hugging Face engineer. And the model is not out; users of today's MiMo 2.5 Pro call it either great

2:45 value or fast but dumb, so the stream is a promise, not a product. Then the fortune nobody claimed. A Hacker News user checked the Bitcoin address in Neovim's website footer and found ten Bitcoin that arrived in March 2023, worth a quarter million dollars then and about eight hundred and thirty thousand today. Nothing has left that wallet since October 2019; donations moved to Open Collective, the footer never did. The thread's top worry is the key, not the money: I hope they still have the

3:15 private key, the crypto version of asking who has the root password after the founder left. Nobody from Neovim has replied yet, so it is either a hardware wallet in a drawer, or a very well-funded paperweight. Now the camera. A collective called stegan0gram removed a Flock license plate reader from a pole outside Milwaukee, imaged its storage, and gave the partitions to DDoSecrets. Micah Lee read the firmware: Android 8.1 from 2017, a security patch level from June 2018, a Linux 3.18 kernel,

3:45 compiled in June 2025. Eight years of missing patches on a device that photographed fifty thousand vehicles in a few days. It gets better. Nineteen of the twenty Flock apps share one library with a hard-coded API key, which the camera trades, with its MAC address, for Auth0 credentials it stores in plain text on a partition built to survive a factory reset. The media partition is encrypted; the key sits next to it in a file.

4:08 Flock says it received no report through its disclosure process, which is technically true, because the researchers reported it to the internet instead. And the good news, small on purpose. A year ago Servo, the Rust browser engine, used its monthly donations to pay one long-time maintainer, Josh Bowman-Matthews, part-time. His report card: one thousand one hundred and fifty pull requests reviewed, eight new maintainers, a hundred and fourteen starter issues, ninety two percent fixed by newcomers.

4:37 That is what a few thousand dollars a month buys when someone remembers to spend it, which, after Neovim, is a pointed remark. If you'd rather read this than hear me say it, the diff lands in your inbox every morning — free at the daily diff dot dev, link below. So — today's verdict: ship it. Seven public restarts and a note that says we found bad patterns and pulled a dataset are worth more than any launch blog, even if the benchmark on the page is still graded by the people

5:05 training the model. Subscribe, hit the bell, and tell me in the comments if you'd have stamped it differently. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. mimo-v2.6 RL live dashboardmimo.xiaomi.com
2. HN: Xiaomi Mimo 2.6 live post-training dashboardnews.ycombinator.com
3. MiMo-V2.5-Pro (1.02T params, MIT)huggingface.co
4. MiMo-V2.5 API price cut (May 2026)platform.xiaomimimo.com
5. HN: Neovim's ~$800k Bitcoin donationnews.ycombinator.com
6. The address, on mempool.spacemempool.space
7. Wired: Hackers Got Inside a Flock Camerawww.wired.com
8. Micah Lee: Flock cameras are riddled with security vulnerabilities and hard-coded credentialsmicahflee.com
9. HN: Flock cameranews.ycombinator.com
10. Servo: One Year of Sponsored Servo Developmentservo.org
11. HN: Servonews.ycombinator.com