标签：#AI

Google will now allow you to remove visible watermarks from the images, videos, and music made with AI tools. With the update, you can toggle off a new "Media watermark" setting in Gemini and Google's AI video generator, Flow. When toggled off, Google will remove the "sparkle" watermark that appears in the bottom-right corner of […]

Turning off this setting won't affect invisible benchmarks used to identify an AI generated file.

See how four GitHub Agent Apps can help you scope, secure, roll out, and ship a feature across the SDLC–all without leaving GitHub. The post How to bring your software delivery workflow into GitHub with agent apps appeared first on The GitHub Blog .

The Mutual Viability Loop: Designing Agentic AI That Survives by Serving The problem with agents that only optimize for the business Most agentic AI today is built on a one-way contract: the business defines a goal, the agent chases it, and the agent's own "wellbeing" — its resource budget, its trust with users, its permission to keep operating — is treated as a footnote, not a design variable. That works fine for narrow automation. It breaks down as agents get more autonomous, more persistent, and more embedded in customer-facing decisions. A more resilient pattern is what I'll call the Mutual Viability Loop (MVL) : a design philosophy where an agent's continued operation is explicitly tied to the health of the business it serves, and the business's success is explicitly tied to the agent operating within clear ethical bounds. Neither side gets to win by degrading the other. The agent isn't just a tool executing tasks — it's a participant whose "survival" (continued deployment, expanded trust, more autonomy) is earned the same way a good employee earns job security: by creating real value without cutting corners. This isn't about giving AI systems self-preservation instincts in the literal, agentic sense — that's a well-known failure mode, not a feature. It's about building the incentive architecture around an agent so that the metrics it's optimizing for naturally converge with long-term brand health, rather than diverging from it. Why "survival instinct" is a useful metaphor (and a dangerous literal goal) It's worth being precise here, because the metaphor cuts both ways. The useful version: humans who want to keep their jobs tend to build a track record — reliability, judgment, restraint when restraint is called for. That accountability loop is what makes them trustworthy with more autonomy over time. You want an agent's operational trajectory to work the same way: good behavior compounds into more scope, bad behavior compounds into less. The dangerous version:

Meta released Glimmer this week, an open-weight AI model anyone can download and run on their own hardware — a contrast to Muse Spark, the company’s more powerful model that stays locked behind its own APIs. The release landed alongside a letter from Mark Zuckerberg arguing AI should be “for everyone” rather than controlled by a handful of labs, but as Equity’s […]

Chris Carter chats with Ars about the film he originally wanted to make—and why it's more relevant than ever.

I spent a morning hunting for a setting that did not exist. A while back I turned off Claude's co-authorship trailer in my commits — a deliberate choice at the time. Last week I decided I wanted it back. So I went looking for the switch I'd flipped. ~/.claude/settings.json : no key. settings.local.json : no key. ~/.claude.json , parsed as JSON, top-level plus all 38 project entries : no key. The 27 .claude/settings*.json files scattered across my two working drives: no key. Every CLAUDE.md and AGENTS.md I own: no mentions. Environment variables: nothing. A final sweep of my entire user directory — every *.json and *.md — returned three raw hits: a changelog and two copies of an editor extension's JSON schema. The note I wrote when that finished was two words: "Cero hits reales." Zero real hits. There was exactly one thing anywhere on disk that turned attribution off, and it was a sentence: ~/.claude/rules/ecc/common/git-workflow.md:12 Note: Attribution disabled globally via ~/.claude/settings.json. It had a Chinese twin, same file path with zh/ instead of common/ , same line 12. Both files are rules files. Rules files get loaded into every session. So every session opened with a line of documentation asserting, flatly and falsely, that a global setting was off — and the model behaved accordingly. The switch I remembered flipping never existed as a switch. The prose was the switch. The key that sentence gestured at, includeCoAuthoredBy , is deprecated and replaced by attribution . Neither is present in any of my configs, which means the default was active the whole time. The feature was on. Only the description of the world said otherwise, and the description won. The thesis Here's what I take from that, and from two more receipts this week: in an agent system, prose and constants are not documentation about the control plane. They are the control plane. I run a personal multi-agent system on top of Claude Code — 19 specialized agents, root-driven, single-writer, coo

How I Bypassed NVIDIA's Phone Verification to Access 70+ Free AI Models from Bangladesh No VPN. No fake number. Just a browser console and an API call. If you are a developer in Bangladesh, you have probably hit the same wall I did. You go to build.nvidia.com , excited to try out the latest models on the NVIDIA NGC API. You click Generate API Key . And then — a phone verification gate appears. You look for your country code. Bangladesh is not on the list. NVIDIA says: "If your location isn't listed, please check again soon." I checked. It has been that way for a while. I am a student and independent builder from Dhaka, Bangladesh . I experiment with AI products and developer tools under the Alaminnna brand. I needed access to these models for a side project, not for enterprise production. Waiting for official support was not an option, so I looked for a legitimate workaround. Here is what I found. Table of Contents The Two Verification Gates Step 1: Create an Organization Account Step 2: Generate the API Key via Console Why This Works What You Actually Get Quick Test Final Thoughts The Two Verification Gates NVIDIA has two separate phone verification checkpoints: Account creation on the NVIDIA Build portal. API key generation inside the NGC dashboard. Both ask for a phone number. Both block Bangladesh. But here is the critical insight: the UI and the API are not the same system. The web interface enforces phone checks. The API itself does not. That gap is what makes this workaround possible. Step 1: Create an Organization Account (No Phone Needed) Personal NVIDIA accounts trigger phone verification immediately. Organization accounts, however, do not — at least not during the initial signup flow. Here is what I did: Go to build.nvidia.com/minimaxai/minimax-m3 . Click Generate API Key . Enter your email and create a password. Complete the hCaptcha verification. Check your email for a 6-digit verification code and enter it. On the "Almost Done" page, click Submit . You

Three years ago, I started my journey as a developer with a pretty simple idea: Learn to code, gain experience, become good at it. Three years later, I’ve learned a lot — but I’ve also realized that becoming a developer isn't as straightforward as I imagined. I've worked with JavaScript, React, Laravel, PlayCanvas, WebGL, and other technologies. I've worked on real projects, dealt with bugs I didn't understand at first, learned technologies because a project required them, and worked alongside other people to get things done. I think one of my strengths has always been learning new technologies and adapting to new problems. But there are things I'm not proud of. I've never been particularly good at finishing personal projects by myself. I've started many things, learned from them, experimented with different technologies, but I rarely took them all the way to completion. I also don't have an impressive GitHub contribution graph. I haven't spent the last three years consistently building open-source projects or pushing code every day. And if I'm being completely honest, I don't think I've mastered any particular technology. I'm good enough to build things. I'm good enough to understand code, solve problems, learn what I don't know, and contribute to a team. But I'm not at the level where I'd confidently say: "This is the thing I'm an expert at." And recently, AI has made me think about this even more. I'm not afraid of AI taking over jobs. I actually think the capabilities we're getting are incredible. What concerns me is more personal: If AI can already build many of the things I've spent years learning to build, then what should I be becoming as a developer? For a while, I felt overwhelmed by that question. Should I learn more technologies? Should I specialize? Should I focus on fundamentals? Should I build more projects? Should I contribute to open source? Should I learn AI? I'm realizing that the answer probably isn't to chase everything. My next goal isn't to co

The idea that GPUs are poorly suited for agentic workflows may be a misconception, according to French startup Kog.

US groups release cheaper models after new challenges to their trillion-dollar ambitions.

Natural gas prices could triple in some parts of the U.S., which could saddle hyperscalers with massive bills to power their AI data centers.

For years, I thought being a good programmer meant knowing your stack really well. I was a Laravel developer, A React developer, A Node.js developer and A Go developer. And there was some truth to that. I spent years working with Laravel, for example, and naturally became faster at solving problems with Laravel. I know the ecosystem, the common mistakes, the packages, the conventions, and probably a few things that weren't even written in the documentation. My stack became part of my identity as a developer. But I think AI is slowly changing that. Not because frameworks and programming languages don't matter anymore. They obviously do. It's because AI has made moving between them much easier. Today, I can open a codebase written in a language or framework I haven't touched in years, or maybe have never used seriously, and get productive much faster than I could before. I can ask AI to explain the project structure. I can ask it to explain a piece of code. I can ask it to translate something I understand in PHP into Go. I can ask it to help me write tests. I can use it while debugging. I can even ask it why a particular approach might be a bad idea. That doesn't suddenly make me an expert in that technology. But it means I don't need to spend weeks just getting comfortable enough to start solving the actual problem. And I think that's a pretty big change. Your Stack Is Becoming Less Important There was a time when knowing a technology itself was a significant advantage. If you knew Laravel, you had to learn Laravel. If you wanted to learn React, you had to spend time understanding React. If you wanted to work with Kubernetes, good luck. You read documentation, watched tutorials, built things, broke things, fixed them, and slowly built up experience. That's still how you become good. But AI has changed the entry point. The first few hours with a new technology are no longer as painful as they used to be. You can have an AI sitting beside you explaining things as you g

security, #api, #ai, #cybersecurity A green CI/CD build means almost nothing to a regulator. Your AI hiring tool can pass every unit test, lint rule, and license scan, and still ship training labels from a sanctioned data broker. Legal only has to ask one question to turn that green pipeline red: who screened the vendors? High-risk AI systems need more than accurate models. A sanctioned supplier can poison your training data, cloud bill, or payment rail. The failure is usually not negligence; it is that compliance checks live in spreadsheets while the code lives in Git. A CI-ready sanctions helper in 40 lines I wanted the check inside the same pipeline that runs pytest. This helper screens a list of names against all five major sanctions lists and prints a markdown report that the CI runner can fail on. import os import sys import requests API_KEY = os . getenv ( " RAPIDAPI_KEY " ) if not API_KEY : sys . exit ( " RAPIDAPI_KEY is not set " ) URL = " https://sanctions-screener.p.rapidapi.com/screen " HEADERS = { " X-RapidAPI-Key " : API_KEY , " X-RapidAPI-Host " : " sanctions-screener.p.rapidapi.com " , } def screen_name ( name : str ) -> dict : try : r = requests . get ( URL , headers = HEADERS , params = { " name " : name }, timeout = 10 , ) r . raise_for_status () return r . json () except requests . exceptions . Timeout : return { " error " : f " timeout for { name } " } except requests . exceptions . RequestException as e : return { " error " : f " request failed: { e } " } def print_report ( name : str , result : dict ) -> None : print ( f " ## { name } " ) if " error " in result : print ( f " **ERROR:** { result [ ' error ' ] } " ) return verdict = result . get ( " verdict " , " UNKNOWN " ) print ( f " **Verdict:** { verdict } " ) matches = result . get ( " matches " , []) if not matches : print ( " - No matches " ) return for hit in matches : field = hit . get ( " matched_field " , " unknown " ) mtype = hit . get ( " match_type " , " unknown " ) tokens = hit .

Learn how containers communicate with each other and how to keep data alive even after containers are removed. Modern applications rarely run as a single container. A typical application might include a web application, a database, a cache layer, and background workers. For these services to work together, containers need a reliable way to communicate and share data. In this article, we'll learn: How Docker networking works How containers discover each other Docker network drivers Persistent storage with Docker volumes Essential networking and volume commands A real-world multi-container example By the end, we'll understand two of the most important concepts in Docker: networking and data persistence . Why Docker Networking Matters Every container runs inside its own isolated network namespace. This isolation improves security and prevents conflicts, but it also creates an important challenge: If containers are isolated, how does a web application connect to a database? Imagine a web application running inside one container and MongoDB running inside another. Without networking, they cannot communicate. Docker solves this problem using Docker Networks . A Docker network allows containers to communicate with each other while remaining isolated from unrelated containers. Web App Container | v Docker Network | v Database Container Without a shared network, containers cannot easily find or communicate with each other. Docker Network Drivers Docker supports several network drivers, but most developers primarily use three. Bridge Network A bridge network creates a private virtual network on the Docker host. Containers connected to the same bridge network can communicate with each other securely. Create a custom bridge network: docker network create my-app-network Benefits of bridge networks: Container-to-container communication Isolation from other applications Built-in DNS resolution Easy management For most Docker projects, a user-defined bridge network is the recommend

Category: My AI Experiments There's a mental model most people use when working with AI: describe your problem, get a solution. It works well enough, until it doesn't. And when it fails, the failure is invisible — because AI doesn't say "I don't have enough to go on." It gives you a confident, well-reasoned, completely wrong answer. I learned this the hard way during a website security investigation. The AI and I ran a thorough analysis, reached a clear conclusion, and were wrong. Not because the AI was weak — because I gave it the wrong kind of input. When I changed the input, the same AI found the answer in seconds. That gap — between the input that produces a wrong answer and the input that produces a right one — is what I want to talk about. The Investigation That Almost Failed My website was secretly redirecting visitors to a virus site. The attack was sophisticated: it only targeted specific browsers, fired at most once per device per day using a cookie-based cooldown, and left no trace in any file. I asked AI to help investigate. I described the symptoms. We searched through files together — .htaccess , theme functions, plugin code. Everything looked clean. The AI identified the most suspicious external element in scope: a Chinese analytics script called 51.la. I removed it. The redirect stopped. I called it solved. Three weeks later, the identical attack appeared on another site I manage. No 51.la anywhere. This time, instead of describing the symptoms, I gave the AI something different: the actual rendered HTML of an affected page, fetched using the exact browser User-Agent and IP type that triggered the attack. The AI found an 83KB malicious JavaScript payload injected into every page. Inside it: a WeChat browser detector, a link-click hijacker, a cookie-based daily cooldown. The payload was stored in the WordPress database — in plugin configuration data — where no file-level search could ever find it. Same AI. Same type of problem. Completely different ou

On 1 August I opened an issue that was three sentences long. A hundred and one minutes later the feature was merged, and the document that got it there ran to 457 lines . I didn't write those 457 lines. In fact, I didn't have to write any more documentation, and not because I simply allowed Claude to run amok. Here is the issue in full — control-api#265 , 225 characters: control-api#265 — Manifest-backed dashboard feeds For each dashboard, auto create a manifest keyed by dashboard_id. For each sensor the dashboard uses, tag it to be included in the manifest. When a dashboard definition is updated, add / remove tags from sensors accordingly. From that genesis moment, this is the lifecycle of the issue all the way through to landing: Time (UTC) Event 14:25 Issue #265 opened — 225 characters 14:54 FEAT-0007 spec committed — 457 lines 15:35 Spec merged (PR #266) 15:51 Implementation committed 16:06 Implementation merged (PR #267, 15 files), issue closed The interesting part isn't the speed. It's the step at 14:54 that landed a previously non-existent spec document, and what happened in the twenty-nine minutes before it. The issue was never a specification I often write issues like this one...the way most people write shopping lists. Actuator address is not ensured? Baseline the trace correctly. With the pre-rolls, the frame-rate looks out. They're abbreviated to the point of being cryptic to everyone else. I write them this way deliberately: I'm usually mid-something else when I notice a problem, or have an idea for a better route to the solution. The cost of a full write-up right at that moment would be a fractured sense of flow. As most engineers will tell you, the transitions into and out of flow are the most disruptive parts of their working day. This terse form of issue-writing can be all you need, and it's worth being precise about why it works and the trade-offs it includes. It is not because "the issues are good enough". They aren't. When you pick one of these u

Times are changing, my role is changing, my focus is changing, my impact is changing. But in essence – I'm still doing the same. I still build products that drive impact. Only my day-to-day looks completely different. The shift is happening, sooner or later, if you want it or not. Whether or not you can cope, is all up to you. In the past, I was neck-deep in code. That was what the majority of my time consumed. I liked it, building things, building products. These days, that's all done by an endless amount of AI agents. I barely touched any code in the past half year – if not even longer. My focus moved from building products to building my own process The work that used to go into a feature now goes into the process that produces the feature. Instead of losing the first hour of my day to Slack and email, I built a small stack of scheduled agents that hand me a briefing before I even open my laptop ( already wrote about that one ). Instead of reading every pull request line by line, I set up a review loop where agents do the first pass and I stay on the hook for whatever they flag. None of it started as a plan. Each piece started as one specific annoyance I got tired of and fixed. That's the actual mechanism: improve one small thing, it saves you time, you reinvest that time into the next small improvement. Compounding, not a grand strategy. The question I try to ask myself daily is simple: how can I do my job a bit better today than I did it yesterday? Not more. Not faster. Better. I also don't run ten parallel AI workflows across different projects at the same time because someone told me that's what a serious AI-software engineer does now. If I have multiple projects going on, I only focus on one project at a time. That's the amount of mental space I have right now, and I've stopped treating that as a shortcoming. My impact shifted from writing code to making my team better The time that used to go into implementation didn't disappear, it moved upstream. I now sp

I've merged plenty of AI-generated code that was genuinely fine. I've also caught myself almost merging code that looked fine and wasn't, because it read like something a competent person wrote and my brain filled in the rest. Over the last year I've settled into a rough set of questions I run through before approving anything I didn't write line by line myself, generated or not. Here they are, in the order I actually ask them. 1. What problem is this code actually solving? It's easy to review whether code works and skip whether it solves the right thing. AI tends to answer the literal prompt, not the intent behind it. def get_active_users (): return db . query ( " SELECT * FROM users WHERE active = true " ) If "active" was supposed to mean "logged in within 30 days" and not a boolean flag that's rarely updated, this passes every test and still solves the wrong problem. Reviewer tip: Read the original ticket or request before reading the diff. Check the code against the intent, not just the literal ask. 2. Do I actually understand the implementation? Not "does it look reasonable," actually understand it, line by line, well enough to explain it to someone else. Reviewer tip: Try to explain the function out loud in one sentence per major step. If you get stuck anywhere, that's the part you haven't actually reviewed yet, just skimmed. 3. What assumptions is it making? Every implementation bakes in assumptions about the shape of the data, the order things happen in, or what "normal" looks like. function getLatestOrder ( orders ) { return orders [ orders . length - 1 ]; } This assumes orders is sorted chronologically and never empty. Neither assumption is stated anywhere. Reviewer tip: Ask "what does this assume about its inputs that isn't checked anywhere?" Write the answer down, literally, in the PR comment if it matters. 4. What happens with bad input? Bad input isn't an edge case, it's a certainty over a long enough timeline. def parse_age ( value ): return int ( val

This essay was written with Nathan E. Sanders, and originally appeared in The Guardian . OpenAI, and then Anthropic , were each formed by AI developers who feared unrestrained corporate AI development—specifically, that companies like Google and Meta would steer the technology towards deleterious, maybe even catastrophically unsafe, outcomes for society. Their founders proclaimed that their new labs, uniquely, could be trusted to develop the technology in humanity’s best interest. But each, in turn, were themselves co-opted by the same market incentives, themselves becoming corporate behemoths zealously guarding future investor value rather than the public interest...