# Model with metacognitive guidance identifies zero-click full-chain RCE in BlueZ

> Source: <https://twitter.com/autopoiesislab/status/2083221810171224416>
> Published: 2026-09-30 23:01:56+00:00

Autopoiesis Sciences on X: "Reinforcement learning rewards convergence, and convergence is the opposite of discovery.
We built the world’s first judgment model from the decisions papers erase: what to pursue, challenge, abandon, and revisit. Columbus-1 autonomously found a zero-click Bluetooth RCE… / X

Autopoiesis Sciences on X: "Reinforcement learning rewards convergence, and convergence is the opposite of discovery.
We built the world’s first judgment model from the decisions papers erase: what to pursue, challenge, abandon, and revisit. Columbus-1 autonomously found a zero-click Bluetooth RCE and designed a 10-foot, self-landing rocket."

Reinforcement learning rewards convergence, and convergence is the opposite of discovery.
We built the world’s first judgment model from the decisions papers erase: what to pursue, challenge, abandon, and revisit. Columbus-1 autonomously found a zero-click Bluetooth RCE and designed a 10-foot, self-landing rocket.

Reinforcement learning rewards convergence, and convergence is the opposite of discovery.
We built the world’s first judgment model from the decisions papers erase: what to pursue, challenge, abandon, and revisit. Columbus-1 autonomously found a zero-click Bluetooth RCE and designed a 10-foot, self-landing rocket.

First, we had to find where judgment lives inside the model.
Holding context fixed and changing only cognitive stance revealed a persistent control surface across key layers. A metacognitive controller can read that state and rewrite it during generation.

Then we scaled it.
Prior dynamic activation-steering work reached 70B parameters. Metacognitive Steering runs on a 1T-parameter model, reading and writing cognitive state at every decode step without changing a single weight.

We pointed Columbus-1 at BlueZ because mature wireless stacks are where shallow search fails.
It found 8 confirmed vulnerabilities, including a nation-state-tier zero-click full-chain RCE: no click, pairing, or interaction. @xchglabs and Enclave Intelligence (@compulsi0n)Show more

Then Columbus-1 moved from code to atoms.
It led development of a 10-foot rocket that lands on solid motors, which cannot throttle or shut off. It generated the CAD, fabrication files, and flight software, then directed humans through the build.
