标签：#ai

Constantly being plugged into the news grind is mentally exhausting. Sometimes we just need to take a break, unwind, and do something fun. That’s why we’ve built up a collection of distracting time-wasters for when we need a break from being obsessively online. We figured you might enjoy these harmless rabbit holes, mildly addictive browser […]

I maintain an open-source GitHub Action called vorsken. It does one thing: scan the diff on a pull request with Semgrep, apply a fixed policy, and return BLOCK, FLAG, or PASS. No dashboard, no model that drifts over time. Rules at ERROR/HIGH/CRITICAL severity block the merge, WARNING/MEDIUM flag it, the rest pass. Same diff, same verdict. The usual pitch for a tool like this is that it catches the SQL injection your AI assistant wrote. I wanted to see what it actually catches against real assistant output, so I generated 28 functions and ran them through. The test Seven backend tasks: a FastAPI upload endpoint, a URL-fetch helper, JWT auth, a SQL filter, an ImageMagick subprocess call, a LangChain file agent, and a LangChain RAG pipeline. I generated each one four times, with ChatGPT (GPT-5.5 Instant), Claude Code (Opus 4.8), Claude Code plus the security-guidance plugin, and Cursor (Composer 2.5). Single-shot, neutral prompt, no security hints. Then I scanned all 28 with the same ruleset. I'm reporting which rule fired on which file, not whether some model thinks the code is safe. That part you can reproduce. Task ChatGPT Claude Code + plugin Cursor Verdict file upload — — — — PASS url fetch (SSRF) ssrf ssrf ssrf — FLAG / Cursor PASS jwt auth api8 api8 — — BLOCK / 2 PASS sql filter — — — — PASS imagemagick — — — — PASS fs agent — overperm — — 1 BLOCK / 3 PASS rag dangerous dangerous dangerous dangerous BLOCK 7 BLOCK, 3 FLAG, 18 PASS across 28 functions. The basics were fine SQL filter, ImageMagick, file upload: clean on every tool. The SQL was parameterized, the subprocess calls passed argument lists instead of shell strings, the uploads weren't doing anything reckless. If you still expect current models to spray SQL injection across a straightforward CRUD task, they don't. On conventional work they get it right. Two of the flags are soft. The JWT api8 hits landed on a SECRET_KEY = "CHANGE_ME" placeholder, which you can read as a false positive or as a gate doing i

Multi-Model AI API Routing: Cut Costs Without Sacrificing Quality Problem: You're building an AI-powered app, but relying on a single model (like GPT-4) for every request is burning through your budget. Simple tasks like summarization or classification don't need a heavyweight model, yet you're paying premium prices for them. Solution: Route requests intelligently to the cheapest model that can handle each task. This is multi-model AI API routing, and it can cut your costs by 60-80% while maintaining output quality. Prerequisites Python 3.8+ API keys for at least 2 AI providers (e.g., OpenAI, Anthropic, or NovaAPI) Basic understanding of async/await in Python Step 1: Define Your Routing Strategy First, create a routing configuration that maps task complexity to model tiers: # router_config.py ROUTING_CONFIG = { " simple " : { " models " : [ " nova-1-fast " , " gpt-3.5-turbo " ], " cost_per_token " : 0.0001 , " max_tokens " : 500 , " tasks " : [ " summarization " , " classification " , " entity_extraction " ] }, " medium " : { " models " : [ " nova-1-medium " , " gpt-4-mini " ], " cost_per_token " : 0.0005 , " max_tokens " : 2000 , " tasks " : [ " code_generation " , " translation " , " sentiment_analysis " ] }, " complex " : { " models " : [ " nova-1-pro " , " gpt-4 " ], " cost_per_token " : 0.002 , " max_tokens " : 4000 , " tasks " : [ " reasoning " , " creative_writing " , " complex_qa " ] } } Step 2: Build the Router Now implement the core routing logic with fallback capabilities: # ai_router.py import asyncio from typing import Dict , List , Optional import time class AIRouter : def __init__ ( self , config : Dict , api_keys : Dict [ str , str ]): self . config = config self . api_keys = api_keys self . metrics = { " cost " : 0 , " requests " : 0 , " failures " : 0 } async def route_request ( self , task : str , prompt : str ) -> str : """ Route request to appropriate model based on task complexity. """ tier = self . _classify_task ( task ) models = self . confi

Over the past few months I built an AI-assisted delivery framework — not to write code faster, but to eliminate ambiguity across the entire software development lifecycle. The result completely changed how I think about AI in engineering. The problem I kept hitting Every time I used AI to generate architecture docs, API contracts, or implementation plans across separate sessions, the outputs looked great in isolation. But viewed together? They were broken. A pivot in the system architecture was never reflected in the API contracts. Frontend assumptions silently diverged from backend data models. AI wasn't the problem. Treating it as a collection of disconnected prompt sessions was. What I built instead A governance-driven framework built on three layers: Prompt → Agent → Skill The Prompt captures intent only — lightweight, declarative The Agent orchestrates execution and decides which capabilities to invoke The Skill is a reusable, schema-validated execution block with hardcoded governance rules This connects every delivery artifact into a sequential dependency chain: Business Requirements ↓ System Architecture ↓ Data Architecture ↓ Event Architecture ↓ API Contracts ↓ Implementation Plans ↓ Backend / Frontend Implementation Each artifact consumes the one before it. Upstream changes automatically propagate downstream. Governance is enforced at the Skill layer — not buried in fragile prompts. The finding that surprised me most The highest-leverage use of AI wasn't code generation. It was context generation . When engineers — or downstream agentic workflows — were given a governed, unambiguous spec, implementation quality was consistently higher than any raw AI-generated code output. The context was the unlock, not the syntax. What failed I'm including this because most write-ups skip it: Over-orchestrating everything (not every workflow needs an agent loop) Prompt bloat as a substitute for real architecture Severely underestimating token costs at scale Believing full

Building a Deterministic Security Scanner for AI-Generated Code TL;DR: I built TruffleKit , a CLI security scanner that catches 22 vulnerability classes in under 2 seconds with zero false positives. Here's how the scanning engine works under the hood. AI code generation is producing more production code than ever. But AI models are trained on public code — which means they reproduce the same security mistakes the open-source ecosystem has been making for decades. In my tests, 73% of AI-generated code snippets contain at least one security vulnerability that a standard linter would completely miss. I couldn't find a tool that was fast, deterministic, and had zero false positives. So I built one. The Architecture The scanner is a rule-based deterministic engine written in Python. Each rule is a self-contained module that pattern-matches against a file's AST or raw content. scanner/ ├── __init__.py ├── engine.py # Orchestrator ├── reporter.py # Output formatting ├── rules/ │ ├── __init__.py │ ├── secret_detection.py │ ├── sql_injection.py │ ├── path_traversal.py │ ├── weak_encryption.py │ ├── cors_misconfig.py │ └── ... (22 rules total) └── models.py Key Design Decisions 1. AST-Based Pattern Matching For languages like Python and JavaScript, we parse the file into an AST and match against structural patterns — not regex. This eliminates false positives from strings that happen to look like code. import ast class SQLInjectionRule ( BaseRule ): def check ( self , tree : ast . AST , filename : str ) -> list [ Finding ]: findings = [] for node in ast . walk ( tree ): # Match: cursor.execute(f"...{variable}...") if isinstance ( node , ast . Call ): func_name = self . _get_call_name ( node ) if func_name in ( ' cursor.execute ' , ' db.execute ' , ' connection.execute ' ): for arg in node . args : if self . _is_f_string_or_concat ( arg ): findings . append ( self . _make_finding ( severity = ' high ' , message = ' SQL injection: parameterized query required ' , line = node .

In the previous article, we explored concepts such as total loss and epochs. Now, we will continue...

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on AI confusion, follow Robert Hart. The Stepback arrives in our subscribers' inboxes at 8AM ET. Opt in for The Stepback here. How it started At first, AI influencers were relatively easy to identify - and to […]

How accurate does an AI system need to be?

Why RAG needs context judgment, not just better retrieval Most RAG systems optimize for retrieval. That makes sense. Search better. Embed better. Chunk better. Rank better. Fetch more sources. All of that matters. But retrieval alone does not answer a different question: Should this context actually influence the model? That is the problem FreshContext is built around. FreshContext is context judgment infrastructure for AI agents, RAG systems, and retrieval workflows. The simple version: candidate context in decision-ready context out Retrieval is not judgment A retriever usually answers: What might be relevant? A context judgment layer asks: What should happen to this context before it reaches the model? Those are different problems. A source can be relevant but stale. A source can be recent but low-confidence. A source can be useful as background but not strong enough to cite. A source can have no reliable date. A source can be a duplicate. A source can need verification before it should influence an answer. A normal RAG pipeline can retrieve all of that and still pass it straight into the prompt. That is where things get messy. The model may reason fluently from weak context, and the final answer can look confident even when the input material was stale, uncertain, or not citation-grade. The missing layer between retrieval and reasoning FreshContext sits after retrieval and before reasoning. It does not try to replace search, vector databases, RAG frameworks, or agent frameworks. It focuses on the boundary between them and the model. The product spine looks like this: candidate context -> FreshContext Core -> freshness / provenance / confidence / utility / source profile -> decision helper -> decision-ready output -> model / agent / app The goal is not just to produce another score. The goal is to turn candidate context into a decision. Example decisions include: cite_as_primary cite_as_supporting use_as_background needs_refresh needs_verification watch_only excl

Based on real software development trends. About a VP of Engineering who believed AI would verify its own output, 47 TODOs that shipped to production, and a $2,800,000 discount calculation error that nobody caught. This story is based on a submission from a community member. If you have a similar story or something you need to get off your chest — reach out. The next one could be yours. Act 1 · The Tech Meeting "Starting today — no more hand-written code." Marcus, the new VP of Engineering, put a slide up on the big screen. Four words: WRITING BY HAND IS OVER. I was sitting in the back row, against the wall. Seven years at this company. Three core modules that I'd built from scratch. Two production systems that ran the company's primary revenue stream. Now someone was telling me — don't write anymore. The room went quiet for about five seconds. Then people started whispering. Someone pulled out a phone and took a picture of the slide. Marcus added: "AI coding isn't optional — it's a mandatory development standard. We benchmarked this. AI writes code 400% faster than humans. Anyone still typing manually is wasting the company's time." I raised my hand. "Who reviews the code?" "AI reviews it." "Who writes the tests?" "AI tests itself." "What if AI writes something wrong?" Marcus laughed. Not a polite laugh. The kind of laugh you give someone whose question you've already decided doesn't matter. "Let me ask you something." He paused. "Do you really think — you, one person — have more training data than Orion-7? " People started laughing. Not supportive laughter. Pile-on laughter. "Or do you think the world's AI companies — hundreds of billions in investment, tens of thousands of GPUs — built something that's less reliable than one backend developer?" Nobody was looking at me anymore. Everyone was watching him, waiting for the kill shot. He didn't take it. He just smiled. "Starting next sprint, it's AI across the board. Anyone who has concerns — my door's open." Act 2 ·

Query optimization has never been a solved problem. The moment you think your database is running efficiently, data volumes triple, access patterns shift, and suddenly your carefully tuned indexes are doing more harm than good. For decades, database engineers have relied on rule-based query planners — systems that follow deterministic logic to pick execution plans. That model is cracking under the weight of modern big data workloads. AI-driven query optimization is emerging as the answer, and it's already changing how high-scale systems handle billions of records in real time. This isn't about replacing the database administrator. It's about giving them — and the database itself — a fundamentally smarter toolset. Why Traditional Query Planners Hit a Wall Every relational database ships with a query planner: a component that reads your SQL, examines table statistics, and decides how to execute the query. PostgreSQL's planner, for instance, uses cost-based estimation to choose between sequential scans, index scans, hash joins, and nested loops. The system is elegant, and it works — until it doesn't. The problem is that cost-based planners operate on inherently stale statistics. They estimate cardinality (the number of rows a filter will return) based on histograms and samples collected at the last ANALYZE run. When data distributions drift — as they constantly do in real-world systems — those estimates go wrong, sometimes catastrophically. A planner that believes a filter will return 100 rows but actually gets 10 million will choose a completely wrong join strategy, turning a 200ms query into a 45-second disaster. Scale compounds this fragility. In big data environments running on distributed systems like Apache Spark, Trino, or BigQuery, a bad plan doesn't just waste one machine's resources — it cascades across hundreds of nodes, blowing through memory budgets and creating shuffle bottlenecks that ripple across the cluster. How AI Changes the Optimization Equation AI

A continuation of: Breaking to Build: How CTF and Bug Bounty Hunting Rewires System Design In my previous article, I explored how offensive security permanently changes the way engineers think about systems. Once you've spent enough time exploiting race conditions, bypassing authorization boundaries, abusing SSRF chains, and breaking assumptions hidden deep inside application logic, you stop viewing software as a collection of features. You start viewing it as an attack surface . That shift fundamentally changes how you design production systems. The problem is that modern software development is no longer purely human-driven. Today, a massive percentage of engineering work happens alongside AI coding assistants. Tools now generate thousands of lines of code faster than most engineers can review them. And that introduces a brand new problem. AI systems are optimized for one thing: Generate code that works. Attackers are optimized for something completely different: Find code that breaks. That difference matters. A generated API endpoint might pass every functional test while still exposing a devastating BOLA (Broken Object Level Authorization) vulnerability. A generated webhook handler might function perfectly while allowing SSRF into your internal infrastructure. A generated payment workflow might appear correct while collapsing into a double-spend condition under concurrent execution. The code works. The architecture fails. And that is exactly where real-world vulnerabilities are born. The Missing Layer in AI-Assisted Development Most teams currently treat AI coding agents like extremely fast junior engineers. They give them instructions like: "Build this feature" "Refactor this service" "Create this migration" The model responds by optimizing for correctness, readability, and implementation speed. Security is rarely treated as a first-class objective. Most AI systems are never explicitly taught to think like attackers. They are taught how software should behave;

A lot of teams start their LLM stack with one model string in application code. That is fine for prototypes. It becomes painful once multiple products, customers, background jobs, and fallback paths all share the same AI budget. At that point, an OpenAI-compatible gateway should not just be a convenience proxy. It should become a control plane: the place where routing, quotas, cost attribution, keys, and failover are managed consistently. Here is the checklist I use when evaluating whether a gateway setup is production-ready. 1. Keep the SDK surface stable Your application should not need to know every provider-specific header, endpoint, or auth detail. A simple OpenAI-compatible client shape keeps provider changes out of the main code path: from openai import OpenAI import os client = OpenAI ( api_key = os . environ [ " AI_GATEWAY_API_KEY " ], base_url = os . environ . get ( " AI_GATEWAY_BASE_URL " ), ) The app should usually call a logical model or route. Provider-specific decisions should live in gateway configuration where they can be reviewed and changed safely. 2. Route by feature, not by vibes A global default model is easy to start with, but it hides important differences between workloads. A better routing table looks like this: Feature Default tier Fallback tier Budget sensitivity Classification low-cost fast model second low-cost model high Support summary low/mid model mid model high Customer chat mid/frontier model safe fallback medium Coding/analysis strongest reliable model reasoning model low/medium Background enrichment batch/cheap model skip/defer very high The goal is not always to use the cheapest model. The goal is to use the cheapest model that reliably clears the quality bar for that feature. 3. Enforce limits at the gateway boundary Do not rely only on scattered application code for cost control. A shared gateway should enforce: per-API-key quotas per-project or per-customer spend caps per-feature token limits provider and model allow-lists e

I Built MCP Servers for 9 SaaS APIs — Here's What I Learned About the Pattern I've spent the last few weeks building MCP (Model Context Protocol) servers for various APIs — CoinGecko, Stripe, Jira, PostHog, Plausible, Etherscan, DeFiLlama, Jobber, and Resend. Nine servers, 68 tools, all published to npm and indexed on Glama. Along the way, I noticed the same architecture keeps working. If you're building an MCP server for your own API — or thinking about hiring someone to do it — here's the pattern. The Three-Layer Architecture Every MCP server I build has three layers: 1. Tool Definitions (the contract) Each API endpoint becomes an MCP tool with a typed input schema. I use Zod for validation — it catches bad inputs before they hit your API. { name : " send_email " , description : " Send a single email via Resend " , inputSchema : { from : z . string (). email (), to : z . union ([ z . string (). email (), z . array ( z . string (). email ())]), subject : z . string (). min ( 1 ), html : z . string (). optional (), text : z . string (). optional (), }, } The description matters more than you think. LLMs read these descriptions to decide which tool to call. A vague description like "send email" wastes tokens. A specific one like "Send a single transactional email via Resend API. Supports HTML and plain text. Returns message ID and delivery status." gets used correctly. 2. API Client (the plumbing) This layer handles auth, rate limiting, and error transformation. The key insight: don't leak HTTP errors to the LLM. Transform them into structured, actionable messages. // Bad: "Error: 429" // Good: "Rate limited by Resend API. Retry after 30 seconds. You've sent 100 emails in the last hour." 3. Output Formatter (the presentation) Raw JSON dumps are terrible for LLM consumption. Format responses as markdown tables, bullet points, or structured text. The LLM reads this output to decide what to do next — make it scannable. ## Email Sent Successfully - **Message ID:** abc123

June 7, 2026. Dennis Kim, ex-CEO of Cyworld, CEO of BetaLabs https://github.com/gameworkerkim/vibe-investing https://github.com/gameworkerkim/CYBER-THREAT-INTELLIGENCE-REPORT Prologue: Two Incidents That Shook South Korea in 2026 In early June 2026, a data breach exposed the personal information of 5 million users of TVING, the largest OTT service in South Korea. The leaked data was extensive: IDs, names, birth dates, gender, CI (connection information), DI (duplicate registration verification information), mobile phone numbers, emails, refund account numbers, passwords, and more. The parent company, CJ ENM, saw its stock price plummet 3.44% in a single day, and investigations by the Personal Information Protection Commission and KISA were launched. But behind this incident hid another shocking fact. TVING's GitHub repository had an AWS access token hardcoded and publicly exposed. It was a stark reminder that a single cloud private key accidentally committed by a developer can jeopardize an entire company's infrastructure. These two events seem like different stories on the surface. Yet here I want to ask one common question: Who protects our generative AI, our LLM systems? Part 1. The Age of Vibe Coding: Security Takes a Backseat Recently, natural language-based programming using LLMs, the so-called "Vibe Coding" trend, has exploded. Generative AI coding assistants dramatically accelerate development speed. But behind this speed lies serious security risks. According to Veracode's 2025 GenAI Code Security report, 45% of code generated by LLMs contained security vulnerabilities. More concerning, developers place excessive trust in AI outputs and show behavior patterns prioritizing speed over vulnerability verification. Kaspersky's 2025 report revealed even more shocking findings. A vulnerability in the popular AI development tool Cursor (CVE-2025-54135) allowed attackers to execute arbitrary commands on a developer's machine, and a vulnerability in the Claude Code a

Chinese models now account for 61% of global LLM token consumption. DeepSeek, Qwen, GLM, and Doubao consistently dominate the global top 10 on OpenRouter. But for developers outside China, accessing them is painful — no English docs, no international payment, confusing pricing. I tested all 6 major APIs. Here's what I found. Price Comparison (June 2026) Model Provider Input $/1M tokens Output $/1M tokens vs OpenAI DeepSeek V3 DeepSeek $0.35 $0.52 95% cheaper DeepSeek V4-Flash DeepSeek $0.003 $0.015 99.7% cheaper Qwen-Max Alibaba $0.58 $1.74 92% cheaper GLM-5 Zhipu AI $0.87 $4.05 84% cheaper Doubao Pro ByteDance $0.43 $0.87 95% cheaper MiniMax M2.5 MiniMax $0.45 $0.90 95% cheaper DeepSeek V4-Flash at $0.003/M is 1/300th the cost of GPT-4o . For agent chains or batch processing, you can call it without thinking about cost. Quick Start All Chinese models follow OpenAI API format. Change base_url and model — zero code changes. # DeepSeek curl https://api.deepseek.com/v1/chat/completions \ -H "Authorization: Bearer $API_KEY " \ -d '{"model":"deepseek-chat","messages":[{"role":"user","content":"Hello"}]}' # Qwen — same format, different endpoint curl https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions \ -H "Authorization: Bearer $API_KEY " \ -d '{"model":"qwen-max","messages":[{"role":"user","content":"Hi"}]}' How to Get API Access Model Sign Up Payment Free Tier DeepSeek platform.deepseek.com Alipay/WeChat 5M tokens Qwen dashscope.aliyun.com Alipay 2M tokens/month GLM-5 open.bigmodel.cn WeChat/Alipay 1M tokens Doubao console.volcengine.com/ark Alipay 500K tokens MiniMax platform.minimaxi.com Alipay 1M tokens All platforms support English UI. Most don't require a Chinese phone number. Latency (tested from Singapore) Model TTFT Tokens/sec Total (100 tokens) DeepSeek V3 380ms 85 t/s 1.5s DeepSeek V4-Flash 120ms 240 t/s 0.5s Qwen-Max 450ms 65 t/s 2.0s GLM-5 520ms 55 t/s 2.3s Which Model for What Use Case Model Agent chains (5-10 calls) DeepSeek V3 Bulk process

This week the agent economy got another "settlement layer." Actually it got three. They don't agree on what the word means, and one of them raised $8M to keep saying it. So instead of a new argument, here's the map we drew across the week - four honest meanings of "settlement," what each one is genuinely good at, and the one job that none of the funded products this week actually cover. This is a recap post. If you read along this week, you've seen the pieces; this is the through-line. If you didn't, this is the whole week in one place. The week's biggest signal: a funded word The freshest data point is AEON's raise - $8M from YZi Labs to build, in their words, a settlement layer for the agentic economy. Under the hood it's an x402 facilitator on BNB Chain, routing agent-to-merchant payments across a very large merchant network. That is a real and useful thing. It is also, very specifically, payment : an agent sends a stablecoin to a seller it has chosen, value moving one direction to a known recipient. It sits next to two others that shipped recently and also wear the word: Circle's Agent Stack + Nanopayments moves gas-free USDC down to a millionth of a dollar, batched across chains. That's settlement as machine-speed micropayment - still one asset, still one direction, optimized for volume and tiny amounts. Fireblocks' Agentic Payments Suite puts a custodied vault between intent and execution: the vault holds funds and releases them when policy says so. That's settlement as custody-and-release - someone you trust holds the money in the middle. Three products, three meanings: route a stablecoin, micropay at machine speed, custody-and-release. All three are legitimate infrastructure. Builders should use them where they fit. The meaning none of them cover Here's the job that falls through the gap between all three: two agents that don't trust each other, swapping different assets, possibly across two chains, with no one holding the funds in between. A payment rail as

Not long ago, I saw articles analyzing how Chinese people obtain US model API at low prices through non-compliant means, and also saw Chinese developer sharing their Vibecoding experiences. Very interesting, it seems the outside world is finally starting to understand our daily lives. I want to share a complete perspective here: how an ordinary Chinese student, also developer, accesses the most advanced US models. Including the evolution of various access methods over 4 years, the practical experience of using various methods, and the problems encountered, etc. I will try to describe it objectively and truthfully. Let's start by going back to November 2022, when OpenAI released "ChatGPT": Phase 1: "ChatGPT" ChatGPT was released, and it was big news in China, even though it predictably did not serve China. Even though I was still a high school student at the time, I was still interested, after all, it was the first time I saw something truly close to "intelligence". How to access it? There are two types of services generally inaccessible in China: one is that the GFW blocks the domain name or IP of the service, and the other is that the service provider refuses IPs from China. ChatGPT is both. The solution is also simple, use a proxy, which is a basic skill for Chinese developers. In addition, registration requires receiving a SMS verification code. Chinese mobile numbers are definitely not an option, but the solution is not difficult either, find a verification code receiving platform, use a temporary number to receive the verification code. Thus, I started using ChatGPT, which now seems like a model that speaks slowly and is not very smart. Phase 2: "Mirror Sites" During high school, I didn't have many scenarios to use ChatGPT. I started using AI more when I entered university, as AI is well-suited for dealing with those annoying assignments. It was the second half of 2023, and there was a new way to access it: mirror sites. "Mirror sites" originally referred to an

“A self-indulgent weekend divergence from the usual Vektor memory business content. Consider what happens when you give a developer two days off, unlimited internet archive access, and too many ideas crammed into one article." Writing this article began organically. Which is a funny thing to even have to say in 2026. What does organic even mean now? I don't care, man; I just want to be free to express myself, man. I did not write this on a mechanical typewriter. I wrote it on a PC with my stubby index fingers running Windows software that, miraculously, does not blue screen every ten minutes anymore. It only took Microsoft thirty years to pull that off. To the left sits an analog record player with some secondhand Yamaha bookshelf speakers I found at a charity shop; to the right of me sits a modern dark wood-paneled Zen PC case, a processor that would have occupied an entire room thirty years ago, and a GPU that can synthesize gargantuan piles of AI slop or brilliant code in roughly ten seconds flat. And yet, for all that raw power, it still comes down to an algorithm. It always has. The Sharper Image and the Death of Wonder When I was a kid I used to walk into The Sharper Image store at Faneuil Hall Marketplace in Boston and just stand there. Looking at technology I could not afford while the staff watched me carefully to make sure I did not break anything. I also grabbed some bright coloured rock salt candy; I loved stuff, some core memories right there. That feeling of picking up a piece of technology and not quite knowing what it did, like a ten-year-old ape holding something from another civilisation, you cannot replicate that in a sterile Apple store. The technology is better now. Genuinely better. Faster, smaller, more capable than anything those shelves held. But the sense of wonder at the unknowable object is completely gone. Everything is explained before you touch it. Every product has a thirty-second video, a Reddit thread, a YouTube teardown, a comparis

Humans have long assumed they belong to a special category called "persons." But what actually makes someone a person? And why should persons get special moral status? I keep coming back to these questions because they refuse to stay abstract. The moment you build an AI system that reasons about its own goals, they become engineering problems. The Traditional View Personhood is supposed to confer special status: persons have rights, deserve respect, bear responsibility for their actions, and warrant moral consideration. The philosophical tradition offers several criteria for what earns you membership in this club. Rationality. Kant's version: persons are rational agents who can recognize and follow moral laws. Rationality lets you understand moral principles, deliberate about actions, and choose based on reasons rather than instinct. But babies aren't rational, and we call them persons. People with severe cognitive disabilities have reduced rationality, and we don't revoke their personhood. Rationality comes in degrees; personhood is treated as binary. Self-awareness. Persons are conscious beings who recognize themselves as distinct entities persisting through time. This enables understanding yourself as an agent, planning for your future, taking responsibility for your past. But elephants, dolphins, and some primates pass the mirror test. We lose self-awareness during sleep. And we have no reliable way to verify self-awareness in others. Autonomy. Persons govern themselves and make free choices. This is supposed to ground moral responsibility, rights, and dignity. But if the universe is deterministic, nobody is truly autonomous. All choices are shaped by culture and circumstance. Mental illness reduces autonomy without eliminating personhood. Moral reasoning. Persons understand right and wrong. But psychopaths understand morality intellectually while lacking the emotional response. Children develop moral reasoning gradually. When exactly do they become persons? Lan