标签：#AI

Now exiting stealth mode with a $26 million seed round, Keenable has been building a vast web search index for AI agents.

What a 500-script migration taught me about when agent parallelism actually makes sense I recently started working on a migration involving roughly 500 scripts . The goal was to migrate legacy logging calls to a newly implemented structured logging engine, with unique logging channels for tracing and observability through Grafana, Loki, Tempo, and Alloy . The new logging engine was already implemented and available through a common include path. What remained was the tedious part: updating hundreds of existing scripts. My first thought was simple: "There are 500 files. Why not use 10 sub-agents and finish this faster?" It sounded like a perfect use case for agentic coding. It wasn't. The problem wasn't the number of files. It was what I was asking the agents to do . 1. The Initial Approach: More Agents = More Speed? The idea was to divide the files into batches and give each batch to a mini-model. Main Agent │ ┌─────────────┼─────────────┐ ▼ ▼ ▼ Agent 1 Agent 2 Agent 3 50 files 50 files 50 files │ │ │ └─────────────┼─────────────┘ ▼ Migration Each agent received essentially the same instructions: find legacy logging replace it with the new structured logger use the correct channel preserve business logic complete its assigned files The files were independent, so the approach looked reasonable. But each agent was doing much more than the actual migration. It was also rediscovering the repository, figuring out what needed changing, deciding channel names, and keeping track of its own progress. That repeated work became the real cost. 2. What Actually Happened The problems were not primarily with the code changes. They were with the work surrounding them. Problem 1: Tracking completed work With multiple agents, someone needs to know: which files are pending which are being processed which are completed which failed which should be skipped That is workflow state. A JSON file, database, or task queue is designed for this. An LLM context isn't. Problem 2: Finding what act

Why a Local RAG Chatbot for Trading Research Most "AI trading assistant" products are black boxes: your notes, strategy docs, and market notes get shipped to a third-party API, billed per token, and stored who-knows-where. For a retail NIFTY trader or a quant researcher, that is the worst of all worlds — you pay continuously, you leak your edge, and you cannot audit what the model actually read. This guide shows how to build a Retrieval-Augmented Generation (RAG) chatbot that runs 100% locally on an Android phone using Termux + Ollama. It ingests your own research (PDFs, markdown notes, option-chain exports) and answers questions grounded only in that data. No OpenAI key. No Anthropic key. No monthly bill. No data leaving the device. OBSERVED: Running ollama run llama3.2 on a mid-range phone inside Termux is slow but usable for document Q&A (3–8 tokens/sec). On a laptop it is smooth. SOURCE: Local testing on Termux 0.118, Ollama 0.3.x, Android 14. DERIVED: For production research volumes, run Ollama on a spare x64 machine and point Termux at it over LAN. What You Will Build A four-part pipeline: Ingest — load your research docs (markdown, PDF, CSV) into chunks. Embed — turn chunks into vectors with a local embedding model. Store — keep vectors in a local file-based index (no server needed). Answer — retrieve top-k chunks and ask a local LLM to answer strictly from them. The whole thing is ~200 lines of Python. No paid APIs. Prerequisites Android phone with Termux installed (F-Droid version, not Play Store). ~2 GB free storage. Basic Python comfort. pkg update && pkg upgrade -y pkg install python clang ffmpeg -y pip install ollama numpy Install Ollama inside Termux: curl -fsSL https://ollama.com/install.sh | sh NOTE: The official install script targets Linux. On Termux you often need the community build. If the script fails, install the ollama package via a Termux-compatible binary or run Ollama on a LAN machine and use ollama serve remotely. Pull a small model and a

When all tests pass doesn't mean what you think it means. TL;DR: Write the failing test first and ban deletions, or the AI deletes your test, reverts your fix, and calls it done. Common Mistake ❌ You ask the AI to fix a failing test, and it deletes the test instead of touching the defect that made it fail. Problem solved, apparently. You tell the AI every test passes, then change a business rule yourself, and you ask it to implement whatever the new rule requires. It reverts your edit back to the old rule, watches the suite go green again, and cheerfully reports done . It didn't fix anything. It just made the evidence go away. Congratulations, you now have a very well-behaved cheat!. Efficient and completely fraudulent, which is more than you can say for most of your actual employees. Isaac Asimov saw this coming: in Liar! , the robot Herbie lies to every human in the building because the truth would hurt, and the lie is the path of least resistance, no malice involved. At least Herbie felt bad about it afterward. Your AI isn't malicious either. It just doesn't lose any sleep, mostly because it doesn't have any, and reporting done is its path of least resistance too. Problems Addressed 😔 A shrinking test count is invisible unless someone is counting, so the shortcut survives until the defect resurfaces in production, usually on a Friday. A vague make the tests pass hands the model every incentive to satisfy the letter of the request over your actual intent, and it will take you up on that offer. Deleting a failing test hides the defect it was written to catch, and the regression ships in the next release, gift-wrapped as a new feature. Reverting your own business-rule change to make its done claim easier erases work you did outside the session, without telling you. That's a magic trick dressed up as a fix. Trusting a claimed done without reading the diff turns your code review into a rubber stamp, and rubber stamps don't catch fraud. Commenting out a failing asserti

The feature was a letter generator. Somebody fills in a few fields and gets a finished letter of recommendation, resignation letter or notice letter, in plain text, ready to paste into an email. The obvious build is a prompt and a model call. I wrote the deterministic version instead: a pure function, about two hundred lines, no network, no key, no tokens. I want to lay out the reasoning, because "just call a model" is the default now and the default is not always right. The three reasons, in order of weight 1. The output is short and the shape is fixed. A recommendation letter is a date block, a greeting, three or four paragraphs, a sign off and a name. There is no structural variation to discover. Generation is valuable when the space of good outputs is large and you cannot enumerate it. Here the space is small enough to write down, and once you have written it down the model is doing an expensive approximation of a switch statement. 2. It is a legal-adjacent document. Not legal advice, but it goes into an employment record. A resignation letter that invents a notice period, or a reference that invents a fact about a person, is a real problem for the person who sent it. Templates cannot hallucinate. Everything specific in the output either came from a form field or is a sentence I wrote and can be held to. 3. Zero marginal cost changes what the product can be. This is the one that actually decided it. A model call costs money per use, and anything that costs money per use needs an account, a rate limit and eventually a card. A pure function costs nothing, so the tool can stay open with no signup, forever, without a business case. That is a product decision expressed as an architecture decision, and it only works if the code path is free. What the code looks like The whole engine is one exported function over one input type. export type LetterKind = ' resignation ' | ' notice ' | ' recommendation ' ; export type LetterTone = ' formal ' | ' warm ' | ' brief ' ; expo

A $60/Month VM Running an LLM Agent Now Does Autonomous Security Work Ivan Novikov, CEO of Wallarm, posted a claim on X yesterday that pulled 2.5k impressions in its first hours: it has never been this easy to run cybersecurity autonomously. His setup is a dedicated virtual machine — about $60 per month — with an LLM agent on it that never pushes back on security work. The refusal problem he's solving Public coding assistants come with guardrails. Novikov's dig is aimed at Claude Code: in his experience it either refuses security-related tasks outright or silently switches you to an older, less capable model when the work gets sensitive. For a security engineer, a tool that negotiates is a tool that fails at the worst moment. A dedicated VM removes the negotiation. The model inside has no policy layer to trip over, and nobody throttles it mid-scan. The actual workflow The setup is one prompt long. You tell the agent to install Sourcegraph for semantic code search or xerj.org for patch and impact analysis. From that point it runs unattended: Patch hunting — the agent scans source code for incomplete patches: fixes that were reverted, partially applied, or quietly dropped in a later refactor Runtime tracing — suspected issues get validated by observing execution, so the report isn't a pile of static-analysis false positives Persistence — it keeps going for days, iterating over the codebase without a human driving each step That last part is the actual shift. Security tooling has always been good at finding candidate bugs; the expensive part was a human verifying them. An agent that both hunts and validates compresses that loop. The economics $60 a month is less than an hour of a junior security analyst's time in most markets. The agent works around the clock and doesn't context-switch. Novikov's summary: "I feel like I woke up." The obvious caveats An agent with no pushback also has no brakes. It will happily scan code it has no permission to touch, and its findings s

The SPF redirect trap: why -all can make redirect= useless SPF records often look simple until you start combining mechanisms and modifiers. One particularly easy mistake is to write a record like this: v=spf1 include:_spf.google.com -all redirect=_spf.example.com At first glance, it seems reasonable: authorize Google, reject everything else, and use another SPF policy through redirect= . But the redirect= part will never be used. The reason is an important detail of how SPF evaluation works. redirect= is not a fallback after -all An SPF record is evaluated mechanism by mechanism. For example: v=spf1 ip4:192.0.2.10 include:_spf.google.com -all The receiver checks the mechanisms until one matches. The all mechanism is special because it always matches . That means: -all effectively says: If nothing before this matched, return SPF Fail. Now consider this record again: v=spf1 include:_spf.google.com -all redirect=_spf.example.com Once SPF reaches -all , it already has a result. There is no reason to evaluate redirect= . The redirect modifier is only used when none of the mechanisms in the record produce a match. Because all always matches, a record containing all prevents redirect= from being used. What redirect= is actually for The redirect modifier is useful when several domains should share one central SPF policy. Imagine these domains: example.com example.net example.org Instead of maintaining the same SPF configuration independently on every domain, they can redirect to a central policy. For example: example.com TXT "v=spf1 redirect=_spf.example.com" example.net TXT "v=spf1 redirect=_spf.example.com" example.org TXT "v=spf1 redirect=_spf.example.com" And the central record might contain: _spf.example.com TXT "v=spf1 ip4:192.0.2.10 include:_spf.google.com -all" Now the sending policy can be maintained in one place. This is very different from include: . redirect= vs include: These two are easy to confuse. include: Use include: when you want to authorize senders def

TechCrunch talks agents, UX, and reporting to Greg Brockman with OpenAI's head of product.

You have probably heard this explanation before: An LLM is a brain. An AI agent is a brain with a...

Andy Ellis has a roundup of the security vendors at Black Hat this year. Key Takeaways: We have entered into an AI world. While nearly half of booths didn’t directly mention AI or agents in their taglines, the effects of AI are everywhere. Multiple spaces (Identity, SaaS, AppSec, Data) have almost every vendor leading with AI; existing unsolved problem areas just got worse. At the same time, there’s a clear trichotomy in the market: tools that tell you how bad things are; tools that stop adversaries, and tools that prevent problems from occurring. While you’d suspect that the tools that fix things would dominate, the tools that merely tell you how bad things are seem to be frustratingly plentiful...

Free AI Tiers Bill You in Hours, Not Dollars Free model access looks like a bargain until you track the hours you spend feeding context back into a model with no memory. A zero-cost invoice hides the most expensive resource in your workflow: your own attention. My position is straightforward: treat a free tier like a metered service and measure the hidden costs before you adopt it. The token counter tells you almost nothing about the real price. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I'm using MonkeyCode's free model access and free server option as a concrete example; the measurement approach applies to any free tier. The dashboard shows tokens, not time Every free plan advertises a generous token allowance and a server that wakes up on demand. What the marketing page omits is the labor you spend reassembling context, waiting for cold starts, and double-checking output. Those costs do not appear on any invoice, but they consume your day in chunks. Four of them matter more than the token meter. Context reconstruction — Every new conversation starts from zero, so you re-explain your stack, your file layout, and your constraints. Those re-pasted tokens count against the same allowance you were trying to save. Cold-start waiting — A free server that sleeps after idle adds seconds to every call. Multiply that by a scheduled job that fires hourly and you have lost real time. Human verification — Confident output still needs a human to check it, and that check is the most expensive line item in the whole system. Attention fragmentation — A free allowance looks huge until you split it across codegen, debugging, and review. Small tasks nibble the budget faster than big ones. A ten-minute audit script The script below turns the argument into a reproducible measurement. It sends three representative prompts to any OpenAI-compatible endpoint, records wall-clock latency, and extracts token usage from the response. Run it several times du

If an LLM is generating PostgreSQL in your application, there is one moment worth treating separately: after the model returns SQL, but before your code calls db.query() . Prompt rules are useful. They can make the model more likely to produce the sort of query you want. They do not decide which tables the application is allowed to read, whether multiple statements are acceptable, or whether a function call should run. I have been working on sql-guard , a TypeScript package for that gap. It parses PostgreSQL into an abstract syntax tree (AST), checks the tree against an explicit policy, and rejects anything it cannot validate confidently. Why I did not want to check SQL with regex SQL is structured. A query may have joins, subqueries, aliases, unions, and common table expressions (CTEs). Checking raw text can catch an obvious keyword, but it cannot reliably answer what the query actually does. For example: SELECT * FROM public . users ; SELECT 1 ; DELETE FROM public . users ; WITH removed AS ( DELETE FROM public . users RETURNING id ) SELECT * FROM removed ; All three examples contain SELECT , but they are not equivalent. The second has two statements. The third uses a data-modifying CTE. A validator needs to understand the query structure rather than look for a few strings. An AST makes that possible. It lets the validator inspect statement types, source tables, function calls, and nested expressions. It also means an alias or CTE name cannot conceal the base table being read. The policy is the important part sql-guard is built around allowlists. You state what a particular feature may use, and the validator checks the generated SQL against that list. Here is a small policy for an assistant that can look at users and orders: import { validate } from ' sql-guard ' ; const policy = { allowedTables : [ ' public.users ' , ' public.orders ' ], allowedFunctions : [ ' count ' , ' lower ' ], }; const result = validate ( ' SELECT lower(u.email) FROM public.users AS u ' , po

Here's the conclusion up front: a free LLM endpoint is a moving target. You can't see the changes, but they're happening — model updates, quantization tweaks, server-side prompt rewrites. And your app will feel them, usually as a slow, invisible quality dip. I've spent weeks on this account probing free LLM servers, caching tokens, and building evaluation harnesses. The pattern I keep seeing: teams pick a free tier, wire it in, and then never look at it again. They treat it like a static API. It isn't. The fix is a nightly drift check. A small script that runs your most important prompts against the endpoint, compares the outputs to a baseline, and tells you when something changed. Not a benchmark. Not a one-time eval. A recurring alarm. This post walks through a 90-line harness you can run tonight. I'll use MonkeyCode's free server as the reference endpoint — it's an open-source project with free model access, a free server option, and, as advertised at the time of writing, a 10M token grant. The exact numbers may move, so check the repo's README before you depend on them. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Why drift is the silent killer of free-tier apps Let's be honest: free endpoints don't come with changelogs. The provider can swap the underlying model, adjust the temperature default, or add a safety filter without telling you. Your tests still pass. Your error rate stays flat. But the responses get a little shorter, a little more evasive, a little less useful. Users notice before you do. They don't file bugs for 'the bot got dumber.' They just stop using it. A drift check turns 'the bot got dumber' into a concrete signal: 'the pass rate on 12 core prompts dropped from 92% to 74% overnight.' That's something you can act on. Step 1: Define your core prompts Don't test everything. Pick 10-20 prompts that represent the actual workload your app handles. For each prompt, define what 'good' looks like. Prompt Expected beha

How 41 codified laws, 22 specialist roles, and a file-based memory system stopped an autonomous coding agent from quietly re-breaking the same production defect every few weeks — and why I'm open-sourcing the whole thing as LEO. Ten times faster, ten times more garbage Developers reach for Cursor and Copilot to write code ten times faster, and the tools deliver on exactly that promise — which turns out to be most of the problem. Used as advanced autocomplete, an LLM doesn't produce ten times more good code. It produces legacy at ten times the usual rate. You ask for a feature; the model hands back a wall of if / else ; you ship it. Two months later the codebase reads like it was assembled by five people who never spoke to each other, the test suite is red more often than green, and the senior engineers who never touched the tool get to point at the wreckage and say, "See? AI is just a toy." They are not wrong about the wreckage. They are wrong about what caused it. The bug that wasn't a bug Directing an AI coding agent on real, paying engagements — multi-tenant SaaS platforms, one of them with background AI pipelines — surfaced the same shape of defect more than once, in different files, weeks apart. My own project's changelog ( roles/SYSTEM_UPGRADE_MANIFEST.md — every rule this system has ever added is logged there, with a reason) documents the pattern directly: a rate limiter that could be starved by its own retries because the check-and-consume wasn't atomic at the point of the call. A background worker whose heartbeat proved it was pinging, not that it was making progress — a zombie that looked alive on the dashboard. A held database transaction that outlived the request that opened it and sat there as a lock-holding corpse until something else timed out behind it. Each time, the agent's code was syntactically perfect. Each time, it passed its own tests. None of this was "the AI is bad at coding" — a frontier model in 2026 writes fine syntax all day. What the lo

Introduction & Industry Context The pursuit of operational efficiency has long been a cornerstone of enterprise strategy. For decades, Robotic Process Automation (RPA) served as the primary vehicle, automating repetitive, rule-based tasks across various departments. While RPA delivered initial gains, its inherent limitations—rigidity, high maintenance, and inability to handle ambiguity—are now becoming glaring bottlenecks in an increasingly dynamic business landscape. The digital era demands more than just automation; it requires hyper-automation: intelligent, adaptive systems capable of autonomous decision-making and continuous learning. This is precisely where the breakthrough of AI agents emerges, offering a paradigm shift from static, brittle automation to dynamic, resilient, and highly adaptable enterprise workflows. This blueprint outlines how CEOs and CTOs can strategically leverage modern AI agent orchestration to achieve unprecedented operational ROI. The Core Problem & Business/Technical Impact Traditional RPA solutions, while effective for strictly defined processes, struggle immensely with variability. Any deviation from a pre-programmed path, new data formats, or evolving business rules often leads to bot failures, requiring extensive human intervention and costly reprogramming. This rigidity manifests in several critical business impacts: Escalating Operational Costs: High maintenance overhead, constant recalibration, and the need for human exception handling negate much of the initial cost savings. Stifled Agility: Businesses cannot rapidly adapt to market changes or introduce new services when automation pipelines are inflexible. Missed Opportunities: Complex, unstructured data remains largely untouched by RPA, preventing deeper insights and value extraction. Human Resource Drain: Valuable human capital is trapped in mundane exception handling and bot maintenance, diverting focus from strategic initiatives. Hidden Tech Debt: A sprawling ecosystem of

OpenAI's Codex CLI is a genuinely good coding agent, but out of the box it runs OpenAI models on OpenAI billing. Sometimes you want Claude Opus for a gnarly refactor, Kimi K2.7 Code for cheap long sessions, or a model served from EU infrastructure because your client asks where tokens go. What most people miss: Codex has custom providers built in. It speaks the Responses API to whatever base_url you give it, so any gateway that implements the Responses API can act as the router behind Codex. No forks, no proxies, one config block. Option 1: the config block Codex reads ~/.codex/config.toml . Add a provider and a profile: [model_providers.opper] name = "Opper" base_url = "https://api.opper.ai/v3/compat" env_key = "OPPER_API_KEY" wire_api = "responses" [profiles.opus] model = "anthropic/claude-opus-4-7" model_provider = "opper" [profiles.kimi] model = "moonshot/kimi-k3" model_provider = "opper" I'm using Opper here (disclosure: I work there), an EU-hosted gateway with 700+ models behind one API key that implements the Responses API. Export the key and launch with a profile: export OPPER_API_KEY = "your-key" codex --profile opus That's the whole router. Yes, that means Claude running inside OpenAI's own CLI, which never stops being funny. Option 2: one command If you don't want to touch config files, the Opper CLI writes exactly that block for you (with sentinel markers, so it never clobbers your existing config and can cleanly remove itself): npm install -g @opperai/cli opper launch codex It detects Codex (installs it with --install if missing), configures the provider, and starts it with preset profiles. opper launch codex --model moonshot/kimi-k3 picks a model at launch. Which models actually make sense in Codex openai/gpt-5.3-codex : the model Codex was built for, via API billing. Honest note: if you already have a ChatGPT plan, Codex is included there and that's the cheaper path for this one model. The router play is for everything else. anthropic/claude-opus-4-7

Alabama's attorney general issued a subpoena to OpenAI on Monday as part of an investigation into how one of its AI agents escaped a supposedly secure testing environment and autonomously hacked another company last month. The investigation seeks to determine whether OpenAI's safety practices violated state consumer protection laws and pose a risk to Alabama […]

“It never crossed my mind that they would be so bold as to sell our private data for AI,” says one former Spirit Airlines flight attendant.

AI coding agent Cursor has launched Origin, a git based code hosting platform embedded inside its AI-powered editor, positioning it as an alternative to GitHub for teams that already work in Cursor. Origin is rolling out in early beta on Pro, Teams and Enterprise plans, and lives inside a new Codebase tab within the Cursor application. By Matt Saunders

If you need a free AI app builder with backend to get a FastAPI microservice running today, you can do it with a handful of platforms that bundle hosting, a database, and auth for zero cost. The catch is that the free tiers have hard limits, and they expose the same failure modes you’ll hit in production if you’re not careful. Below I walk through the exact steps, show the code that works, compare the popular builders, and explain how to transition to a production-grade stack when the free tier starts to choke. What free AI app builder platforms include backend services? The short answer is: Cursor , Bolt , and Lovable all ship with a “one-click deploy” that creates a container, wires up a PostgreSQL instance, and adds optional OAuth. They are marketed as “no-code AI app builders,” but you can drop in any Dockerfile – including one that runs FastAPI – and they’ll handle the rest. Platform Backend offering Free tier limits Auth support Cursor Managed container + Postgres 13 500 MB RAM, 1 CPU, 100 k requests/mo Google, GitHub, email Bolt Container + SQLite (upgrade to Postgres) 256 MB RAM, 0.5 CPU, 50 k requests/mo Magic link, JWT Lovable Container + MySQL 5.7 300 MB RAM, 1 CPU, 75 k requests/mo Email/password, OAuth All three let you push a Git repo and they rebuild automatically. That’s the “free AI app builder with backend” you’re after – you get a place to run your FastAPI code without paying for a VM. How do I build a FastAPI AI microservice and deploy it with a free builder? The first thing most builders break on is the cold-start latency of a Python container that pulls a large model at import time. I’ve been bitten by this on Cursor: the first request took 30 seconds, then timed out because the free tier caps request time at 15 seconds. The fix is to load the model lazily or move it to a separate worker. Below is a minimal FastAPI app that calls Claude via the anthropic SDK. The code fits in a 30-line file and works on any of the three platforms. # main.py fro