标签：#ai

The most AI-obsessed firms are spending roughly $7,500 monthly per employee on AI, per Ramp AI Index. That's not more than an engineer's salary — yet.

Anthropic released Claude Fable, its first Mythos-class AI model, yesterday and it's already causing concerns inside Microsoft. Sources tell me that Microsoft is limiting the use of Claude Fable 5 for employees because of Anthropic's new data retention requirements. While Microsoft quickly rolled out Claude Fable 5 to its GitHub Copilot and Foundry customers, I'm […]

Move also cuts off a massive market of legit users who buy cards with physical cash.

Google is making some changes to how it saves your interactions with Search. In an email sent to users, Google says it will save the images, files, audio, and video you use to search under a new "Search Services History" setting. That includes the images you search for with Google Lens, recordings from its real-time […]

New research suggests that AI memory systems can degrade model performance and encourage sycophantic tendencies.

Install and configure LSP servers for GitHub Copilot CLI, replacing brute-force grep/decompile with real code intelligence. The post Give GitHub Copilot CLI real code intelligence with language servers appeared first on The GitHub Blog .

In my last post I complained — a lot — about product managers and how they made my life hell with vibe code. PS: apologies, manager, if you're reading this — but it's true. Now, I'm not here just to complain. There were a lot of learning opportunities too, like how to handle legacy / vibe code. Because at the end of the day, both are the same: no one knows how they work, but somehow they keep working. Touching them is like defusing a bomb — you never know how your change might cascade and break the core logic. The good news is that vibe code is much simpler than legacy. AI, in all its glory, tries to write perfect-looking code — proper function names, comments, the works — not like legacy code where a single function runs 500 lines, with spaghetti names all over that make no sense and comments that are out of date. And that makes it something I can actually handle. I still don't have a perfect, step-by-step playbook — but I've got pieces. The first one. The cheapest and the oldest one. The one the industry solved decades ago and the whole "AI built my app in a day" crowd somehow forgot exists. A linter. Yes, you heard me right. A linter. ESLint. Most people who've been in this industry already know it. It's the most boring, reliable tool in the box. But in an era where the answer to every problem is "add another AI," it's worth saying out loud why the boring tool still wins. What a linter actually is If you vibe-coded your way into this world, or you're new to web dev in general and have never heard the word "lint", here's the honest version. A linter is a set of rules you add to your repo. It reads your code without running it, checks it against those rules, and flags everything that's broken, sloppy, or about to bite you in production. The detail people get wrong: it's not a grep for bad words. A real linter parses your code into a syntax tree and actually reasons about its structure — what's imported, what's called, what's reachable, what types flow where. That's

Cybersecurity researchers are complaining that Anthropic's new model Fable has guardrails that are too strict for any cybersecurity work.

Your users have started asking ChatGPT and Perplexity instead of Google. So here is the uncomfortable question: when someone asks an AI engine "what is the best tool for <your category> ", does your product show up in the answer? Most founders have no idea. I didn't either, until I measured it — and the gap was nowhere near where I expected. So we built a CLI to measure it. It's called aeo-platform , it's MIT-licensed, it has zero runtime dependencies, and it runs entirely on your machine. This post is the five-minute version: install it, point it at your domain, and read the gap. I'll show you the exact commands and the real before/after numbers from running it on one of our own products. Quick framing on terms: AEO (answer engine optimization) is just SEO's younger sibling for AI answers — getting cited inside the AI's response instead of ranking on a SERP. Some people call it GEO. Same field. TL;DR — three commands npm install -g aeo-platform export OPENAI_API_KEY = "sk-proj-..." # required export GEMINI_API_KEY = "AIzaSy..." # required aeo-platform init --yes --brand = YOURBRAND --domain = YOURDOMAIN.COM --auto \ && aeo-platform run \ && aeo-platform report init auto-discovers your category and writes three commercial buyer queries to a local .aeo-tracker.json . run fires those queries at each engine and scores the answers. report opens a single-file HTML report in your browser. The whole thing installs in under a second (no dependency tree to resolve) and writes everything to disk under aeo-responses/YYYY-MM-DD/ — nothing is sent to a hosted dashboard. OpenAI and Gemini keys are mandatory (they also power a two-model cross-check that filters hallucinated brand mentions). Anthropic and Perplexity keys are optional — each one just adds a column to the report. What it actually measures A single run sends your buyer queries to four engines through their official REST APIs — no scraping, no proprietary black-box score: Engine Model Type ChatGPT (OpenAI) gpt-5-search

I ran the same browser smoke task through two paths: direct Chrome DevTools MCP and a custom CLI skill around mcp2cli . In GitHub Copilot CLI with gpt-5.3-codex-medium , direct Chrome DevTools MCP added about 5k tokens of upfront context before the agent did any work. The runtime table is too small and too noisy to rank the tools. The useful question is where the agent pays to discover the browser-control surface. mcp2cli README says it can “Save 96-99% of the tokens wasted on tool schemas every turn.” That is a strong claim and frankly I didn't no expect that sort of numbers... It's just the CLI part resonates with me - (a) there's no system prompt pollution with CLI, (b) if you choose between gh CLI and GitHub MCP the former would be better due to the fact that model already knows the tool and there's less tokens wasted on JSON schemas and tool calls. I used Chrome DevTools MCP a lot and I have chosen this MCP as a test bed to try mcp2cli . This came handy cause I started my experiments with the minimal pi coding agent and it doesn't bundle any MCP integration, just the basic bash tool, I was very much happy not to bloat my instal with a dedicated MCP plugin. Although in this cases I cmpared MCP vs CLI using a fully fledged GitHub CLI. Tool discovery is part of the experiment. Native MCP gives the agent a tool surface by loading schemas into context. A CLI wrapper makes the agent discover the surface the way it discovers any other command-line tool: list, search, ask for help, run a small probe, write down what worked. That changes where the discovery cost lands. The Setup I ran this in GitHub Copilot CLI using gpt-5.3-codex-medium : Copilot stock MCP servers were disabled. The app under test was a private Pythobn/Streamlit codebase. The browser task was the same 9-step smoke test in both variants. One variant used direct Chrome DevTools MCP. Another variant used a custom skill that wraps Chrome DevTools MCP via mcp2cli . The custom skill itself started as an ad-h

The Problem With Talking Directly to LLMs Most teams start by wiring their app straight to the OpenAI API. It works — until you need to add auth, rate limiting, observability, or swap out the model provider. Now you're rewriting application code instead of config. An AI Gateway solves this. One entry point, one place to govern traffic, providers become swappable. Kong Gateway is a mature choice here — it's been doing this for APIs for years, and the AI Proxy plugin extends that to LLMs. This post walks through the key ideas. For the full step-by-step guide, head over to the tutorial on Hashnode . What We're Building A Kong Gateway 3.14 data plane running on Kubernetes (kind locally), connected to a Kong Konnect control plane. The AI Proxy plugin sits on a route and handles forwarding to OpenAI — your app just talks to Kong. Your app → POST /ai/chat (Kong proxy) → AI Proxy plugin attaches API key → OpenAI API → response back to your app Your app never holds an OpenAI key. Kong does. You get rate limiting, logging, and model-swapping for free at the gateway layer. The Key Bit: decK Config as Code The most interesting part of this setup is using decK to define the service, route, and plugin as a YAML state file — then syncing it to Konnect, which pushes it down to the data plane automatically. # kong-ai.yaml _format_version : " 3.0" services : - name : openai-service url : https://api.openai.com routes : - name : openai-chat-route paths : - /ai/chat plugins : - name : ai-proxy config : route_type : llm/v1/chat auth : header_name : Authorization header_value : " Bearer $OPENAI_API_KEY" model : provider : openai name : gpt-4o options : max_tokens : 512 One sync command and Konnect pushes the config to every connected data plane: deck gateway sync kong-ai.yaml \ --konnect-token " $KONNECT_TOKEN " \ --konnect-control-plane-name "kong-ai-tutorial" Once it's live, a single HTTPie call confirms the whole chain is working: http POST localhost:8080/ai/chat \ Content-Type:applic

Reentrancy is the oldest trick in smart contract exploitation. The DAO fell to it in 2016. You would think a bug this famous would be extinct by now. It isn't. Protocols still lose millions to reentrancy every year, because the textbook version is the easy one, and attackers stopped using the textbook version a long time ago. This post walks through the classic bug, then the modern variants that still bite in 2026: cross-function, cross-contract, read-only reentrancy through view functions, and callback reentrancy through ERC777 and ERC721. I'll show why ReentrancyGuard is not the silver bullet most developers think it is, and how an LLM-based auditor reasons about the call-then-state-change pattern in a way pattern matchers can't. The Classic: Single-Function Reentrancy Here is the canonical vulnerable withdraw. contract VulnerableVault { mapping(address => uint256) public balances; function deposit() external payable { balances[msg.sender] += msg.value; } function withdraw() external { uint256 amount = balances[msg.sender]; (bool success, ) = msg.sender.call{value: amount}(""); require(success, "transfer failed"); balances[msg.sender] = 0; // state update AFTER the external call } } The attack is simple. The attacker is a contract. When withdraw sends ETH via msg.sender.call , control passes to the attacker's receive() function before balances[msg.sender] is zeroed. The attacker calls withdraw again. The balance is still the original amount, so the vault pays out again. Repeat until the vault is empty. contract Attacker { VulnerableVault vault; receive() external payable { if (address(vault).balance >= 1 ether) { vault.withdraw(); // re-enter before balance is zeroed } } } The fix is checks-effects-interactions. Do all your checks, then update all your state, and only then make the external call. function withdraw() external { uint256 amount = balances[msg.sender]; balances[msg.sender] = 0; // effect first (bool success, ) = msg.sender.call{value: amount}(""); //

Part 7 of 7 · Series: Building Your AI Developer Handbook · GitHub The Scenario You're building a password reset feature. User enters email → gets a reset link → clicks link → enters new password. Standard flow. Medium complexity. Let's walk through every step using the full workflow — as if you're looking over the shoulder of someone who built this system. "Show me your workflow and I'll show you your output quality." Before You Even Type Claude loads automatically in the background: ✓ ~/.claude/CLAUDE.md loaded ← the global handbook ✓ .claude/CLAUDE.md loaded ← project rules (TypeScript, pnpm) ✓ memory/MEMORY.md scanned ← all lessons and preferences You haven't typed anything yet. Claude already knows: Feature-based folder structure State management ladder No mocking the database No AI attribution in commits No useCallback without profiler evidence "A doctor who reviews your file before you enter the room is more useful than one who asks 'so, remind me who you are?'" Step 1: /status — Confirm the Setup /status Model: claude-sonnet-4-6 Effort: normal Plugins: security-guidance ✓ Thirty seconds. Sometimes the wrong model loads due to overload fallback. Sometimes a plugin fails silently. This check costs 30 seconds and prevents a surprise 30 minutes later. "A pilot's first action after sitting in the cockpit isn't to take off. It's to check all instruments are reading correctly." Step 2: /cost — Baseline /cost → Tokens used: 2,847 | Estimated cost: $ 0.004 Note this number. You'll compare it later before the expensive code review step. A surprise spike means something went wrong. Step 3: /plan — Design Before Coding /plan Build a password reset feature: - User enters email on /forgot-password - System sends a reset link (token, expires in 1 hour) - User clicks link → /reset-password?token=xxx - User enters new password - Token validated, password updated, token invalidated Claude responds with a plan — no code yet : Proposed approach: 1. DB: Add password_reset_tokens

Gemini in Chrome continues to roll out and has now landed in Latin America, the Middle East and Africa.

AI coding agent startup Niteshift has raised a $7 million seed round from a who's who of angels. It's betting companies will want power over, not lock-in with model makers.

Most of the value in SpaceX's IPO is effectively a call option on the company's ambitious space data center plans.

Through the acquisition, WMG aims to better track when its artists' work is used in AI-generated content or for training AI models.

Over 15 years after David Fincher and Aaron Sorkin's The Social Network premiered in theaters, Sony has released the first trailer for The Social Reckoning ahead of its theatrical release on October 9th. The follow-up takes place 17 years after the events portrayed in the original film and follows a young Facebook engineer who enlists […]

The funding round was led by Norwest, with participation S Capital VC, Cerca Partners, and Oceans Ventures. Snowflake Ventures also participated as a strategic investor.

Decart is launching Oasis 3, a real-time world model that generates photorealistic driving environments for autonomous vehicle testing, now available via API for developers to build on.