标签：#ai

This week, the first offline-first PWA went live on WebsitePublisher.ai . A travel blog that works without internet. Write posts on a plane, attach photos, and everything syncs the moment you reconnect. Service Worker, IndexedDB, sync queue — the full stack. The twist: it was built entirely through conversation with an AI assistant. No IDE, no terminal, no deploy pipeline. How that works WebsitePublisher.ai exposes 92 integrations as building blocks via MCP (Model Context Protocol). Any AI assistant — ChatGPT, Claude, Cursor, Windsurf, Copilot, Gemini, Grok, Mistral — connects to the same runtime and assembles these blocks into working applications. The offline-first PWA is one of those blocks. The AI doesn't generate a Service Worker from scratch. It activates a proven, tested building block and configures it for the use case. We call this wave coding — one deliberate wave of proven pieces, instead of 15 fragile vibe-coding attempts. What shipped recently Offline-first PWA building block — push/pull sync, conflict handling, IndexedDB storage, works on iOS 92 integrations (up from 78) — 45 built-in, 47 bring-your-own-key Integration stacks — pre-composed combinations: e-commerce (13 integrations), lead generation, B2B prospecting, booking, content/blog 9 AI platforms supported — all via MCP, no vendor lock-in 416 API endpoints across the platform ## The architecture in short AI assistant (any) → MCP → WebsitePublisher runtime ├── PAPI (pages + assets) ├── MAPI (structured data) ├── SAPI (forms + auth + sessions) ├── IAPI (integration proxy) ├── VAPI (encrypted vault) └── AAPI (scheduled AI agents) Credentials never touch the AI. They're stored AES-256-GCM encrypted in the vault and injected server-side during execution. The positioning We're not competing with Lovable or Bolt on the chat interface. We're the Supabase + Vercel + n8n underneath — reachable via whichever AI you already use. The platform your AI builds on. websitepublisher.ai

The New York State legislature passed a one-year moratorium on new large data centers, the first statewide ban of its kind if Democratic Governor Kathy Hochul signs it into law. Lawmakers behind the bill say it's meant to give policymakers time to understand the impact of large data centers on the environment and energy prices. […]

"The whole conversation shifted from tokenmaxxing and 'go fast' to 'we need guardrails, how do we control this?'"

It's the first instance of an vaccine antigen designed exclusively by artificial intelligence.

OpenAI details Codex Windows sandbox architecture, showing how SIDs, ACLs, restricted tokens, and dedicated sandbox accounts enable safe execution of autonomous coding tasks. The design balances isolation with real developer workflows and shows how OS security primitives must be composed for AI agents on local development environments. By Leela Kumili

When Quilty hit the industry trades earlier this year, the AI startup promised that its tool could accurately predict a film's success just by reading the script. When people actually got a chance to experiment with Quilty's product, though, they were left skeptical. Even with all the available data in the world, it predicted the […]

Researchers have prototyped an AI-powered internet worm . The coolest thing about the prototype is that it carries its own LLM with it, and runs it on computers that have been broken into. This is the closest to John Brunner’s original 1975 conception of a computer worm that I’ve seen.

The Australian data center operator plans to set up 5GW of capacity in India.

Sylwia Laskowska's webMCP article is clever, funny, and genuinely enjoyable—and she's explicit that it's experimental, not a production recommendation. This isn't a rebuttal. It's a reframing: the same demo, viewed through the lens of risk surfaces and governance. My concern isn't with her intent — it's with how easily newcomers building client systems may misread a playful demo as a pattern to copy. I. The Demo Was Funny Because the Risk Is Real In Sylwia's article, she writes: webMCP allows websites to expose structured information about available actions… Those "actions" aren't descriptive hints. They are callable functions wired directly into application logic. In her demo, those actions include: hire_employee fire_employee rewriteInRust pivotToAgents It's hilarious in a toy app. It's catastrophic in a real one. The humor works precisely because the underlying risk is real. II. The Hidden Assumption: Exposing Actions Is Neutral webMCP is framed as "like accessibility metadata." But accessibility metadata is descriptive. webMCP metadata is executable. That's the conceptual inversion most newcomers will miss. III. Structural Vulnerability #1: Unbounded Action Surface If a tool exists, an agent can call it. There is no: permission model capability scoping rate limiting intent validation safety envelope Sylwia jokes: "someone will definitely give an agent access to fireEmployee(), the agent will lay off the entire company…" This is not a hypothetical. It is the exact failure mode. IV. Structural Vulnerability #2: Agent Overreach Her CEO sim demonstrates the problem perfectly: the agent selected the appropriate tools and immediately got to work. Agents act with high confidence even when their world model is incomplete. webMCP gives them direct levers into application state. This is the same overreach problem MCP has—just moved into the browser. V. Structural Vulnerability #3: Protocol Brittleness webMCP relies on human-authored descriptions: html<form mcp-name="creat

TL;DR I built AutoMaintainer , a multi-agent AI system that transforms GitHub issues into production-ready pull requests during the Qwen Cloud AI Hackathon. It coordinates specialized agents (Issue Analyst, Developer, QA, Security, Documentation, Reviewer) to solve problems like a real engineering team—all while keeping humans in control. Here's what I learned. The Problem Open-source maintainers face a brutal reality: 📚 Overwhelming issue backlogs 🔄 Repetitive bug fixes and documentation gaps ⏱️ Code review bottlenecks 😴 Burnout from handling everything solo Existing AI tools help write code, but they don't orchestrate the entire workflow: planning, development, testing, security review, documentation, and human approval. What if we could build an AI engineering team that collaborates like real developers? The Solution: AutoMaintainer AutoMaintainer is a multi-agent orchestration system that mirrors a real software company: Issue Analyst – Reads GitHub issues, extracts requirements, assesses severity Architect – Analyzes repo structure, designs the implementation approach Developer – Writes code, updates files, creates new modules QA Tester – Generates tests, validates fixes, checks edge cases Security Agent – Scans for vulnerabilities, prevents dangerous patterns Documentation – Updates changelogs, PR summaries, release notes Reviewer – Scores code quality, recommends improvements Human Approval Gateway – Final human review before merge The result? A pull request that's analyzed, built, tested, secured, documented, and reviewed—all before a human ever sees it. Tech Stack Frontend Next.js – React framework for the dashboard UI Tailwind CSS – Rapid, utility-first styling TypeScript – Type safety for the frontend layer Backend FastAPI (Python) – Lightweight, async-first API Qwen-compatible LLM API – AI model integration for all agents SQLite + Async (aiosqlite) – Persistent pipeline and memory storage Redis-ready architecture – Prepared for distributed queuing Integr

The company said this week it would comply with President Trump's voluntary AI executive order.

LinkedIn’s Karthik Ramgopal and Prince Valluri discuss leveraging AI as a new execution model for large-scale engineering. They explain how to move beyond fragmented implementations by building platform abstractions for orchestration, structured context, and safe tooling like MCP. They share architectural insights from real-world coding, observation, and UI testing agents built at LinkedIn. By Karthik Ramgopal, Prince Valluri

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built AdeptAI is a...

Dropbox has unveiled Nova, an internal platform designed to orchestrate and operationalize AI coding agents across the company's engineering workflows. By Craig Risi

“Why wouldn’t you want to be in both Pepsi and Coke?” says one venture capitalist. “It’s the same here.”

Over the past few months I’ve been building VoiceIntego, an AI voice agent that answers calls and books appointments for service businesses (dental clinics, HVAC, plumbing). Here are some of the technical lessons that surprised me along the way. Latency is the whole game With text chatbots, a 2-second delay is fine. On a phone call, anything over ~800ms feels broken — people start talking over the AI. The hard part isn’t the LLM response; it’s the round trip: speech-to-text → LLM → text-to-speech, all streaming. You have to stream every stage and start TTS before the full response is generated. Interruptions break naive pipelines Real callers interrupt. “Actually, can we do Tuesday instead—” mid-sentence. A simple request/response loop can’t handle this. You need barge-in detection: monitor the incoming audio stream and cancel the current TTS playback the moment the caller starts speaking again. Booking logic needs guardrails, not vibes Letting the LLM “decide” availability is a recipe for double-bookings. The reliable pattern: the LLM extracts intent (date, time, service), then deterministic code checks the actual calendar API and confirms. The model handles language; your code handles truth. Confirmation loops matter more than you’d think Always read the booking back: “So that’s a cleaning on Tuesday the 9th at 2pm — correct?” Phone audio is noisy and names/times get misheard constantly. One extra confirmation turn cuts errors dramatically. Phone numbers and edge cases everywhere Voicemail detection, callers who mumble, background noise, people who say “yeah” to mean no. The happy path is maybe 20% of the work. If you’re building something in this space, happy to compare notes. You can see what I’m working on at VoiceIntego .

Your AI vendor says "trust us" with your data. At the end of June, ByteDance's Doubao (豆包) officially ends its free tier and starts charging for API calls. The discussion in developer communities quickly shifted from pricing to a different question: all this data flowing to cloud AI services every day — where exactly does it go? Around the same time, NVIDIA spent significant stage time at GTC 2026 presenting the full-stack confidential computing capabilities of the Vera Rubin architecture. Jensen Huang's message was clear: future AI chips need to keep data encrypted throughout the computation process, making it inaccessible in plaintext to anyone — including the cloud service provider. Two signals pointing to the same trend: data security in AI services has moved from "someone mentioned it once" to "you need to answer this directly." The Data Path Through Cloud AI Is More Complex Than You Think Most developers have a simple mental model of cloud AI: I send a request, the model returns a result, and my data is gone. The actual data flow is more involved. A typical cloud AI call touches these steps: Request data travels over HTTPS to the service endpoint The service may queue the request while waiting for GPU allocation During inference, input data exists in plaintext in server memory After inference, whether inputs/outputs are cached or used for subsequent training depends on the provider's privacy policy Logging systems may record request metadata or partial content At each step, data is potentially accessible. Providers typically say "we don't look at your data" and "your data won't be used for training" in their privacy agreements. These are contractual commitments. You need to trust that they'll honor them. This is the "Trust Me" model. Trust Me vs Verify Yourself If you roughly categorize data protection approaches in AI services, two paradigms emerge: Trust Me Data leaves your device and is processed by a third party. The provider guarantees security through co

After GTC 2026, one thing is basically settled: the hardware layer for on-device AI is no longer the bottleneck. NVIDIA's RTX Spark packs Blackwell GPU + Grace CPU + 128GB unified memory into a desktop form factor. Apple's M-series chips with unified memory architecture and efficiency-first design let 4B and even 7B parameter models run smoothly on a MacBook. Two different approaches, same destination: consumer hardware now has the compute foundation for running on-device AI agents. Chip vendors have done their part. The next question is: how many layers are still missing between "chip can run an AI model" and "an on-device agent can actually complete useful tasks"? This post maps out the full technology stack for on-device AI agents, examining each layer's maturity, identifying gaps, and tracking what the open-source community has built so far. Layer 1: Silicon (Ready) On-device AI inference has different chip requirements than traditional compute workloads. The core bottleneck isn't peak FLOPS — it's memory bandwidth and unified memory capacity. LLM inference needs model weights fully loaded into memory, with high-frequency data movement between weight matrices and activations during computation. If memory bandwidth can't keep up, raw compute power just sits idle waiting for data. Three main silicon paths exist today: NVIDIA N1X : Blackwell GPU + Grace CPU heterogeneous architecture, 128GB unified memory, petaflop-class compute, targeting desktop workstations Apple M-series (M4/M5) : Unified memory architecture with GPU and CPU sharing memory, optimized memory bandwidth, configurations from 32GB to 192GB Qualcomm Snapdragon X : Targeting laptops and mobile, NPU-accelerated inference, relatively limited memory configurations Different emphases, but one common takeaway: 2026 consumer silicon can run 4B+ parameter models for real-time inference. This layer is ready. Layer 2: Inference Frameworks (Mature) With silicon in place, efficient inference frameworks are neede

I added real-time activity logging and security scoring to my Claude Code dashboard The problem with just seeing costs Knowing how much you spent is useful. But it's not enough. The real question is: what is your AI actually doing? Which files did it read? Which commands did it run? Is your environment even safe to run it in? I couldn't answer any of those. So I built the answers in. What's new in v0.1.17 Activity Log — see every action in real-time Claude Code logs everything via hooks. Every file read. Every command executed. Every API call. Risk-labeled. Timestamped. Live. Set it up once in ~/.claude/settings.json : { "hooks" : { "PostToolUse" : [{ "matcher" : ".*" , "hooks" : [{ "type" : "command" , "command" : "curl -sf -X POST http://localhost:3000/api/actions -H 'Content-Type: application/json' --data-binary @- 2>/dev/null || true" }] }] } } Then open http://localhost:3000/activity . Watch your AI's actions stream in real-time. This is the audit layer AI agents have been missing. Security Score — how safe is your Claude Code environment? Scored out of 100. Checks 7 things: Is Bash(sudo *) in your allow list? (-20) Is ~/.ssh/** in your deny list? (-20) Is Bash(curl *) unrestricted? (-15) Are .env files protected? (-15) Is strictMode enabled? (-10) Is Bash(rm *) restricted? (-10) Are hooks configured? (-5) I scored 90/100. What's yours? The point isn't to shame anyone. It's to make the invisible visible — so you can make informed decisions about what your AI is allowed to do. Try it npm install -g @notenkidev/claude-token-dashboard claude-token-dashboard Open http://localhost:3000 GitHub: https://github.com/notenkitoclient-cpu/claude-token-dashboard This started as a simple token counter. It's becoming something bigger — an observability layer for AI agents. More coming.

Indie Hacking the App Store: Navigating Apple's Guidelines for Niche Catholic AI Applications The era of building generic software-as-a-service (SaaS) platforms is shifting. For independent developers and indie hackers, the real opportunity now lies in underserved, highly specific markets. One of the most fascinating and complex niches emerging today is the intersection of artificial intelligence and religious utility. Building a catholic ai application presents a unique set of technical, ethical, and regulatory hurdles. Developers must create highly accurate systems while navigating strict platform guidelines. Unlike general-purpose chatbots, religious applications require absolute precision. A single theological error can ruin user trust. Furthermore, platforms like the Apple App Store have strict rules regarding user safety, privacy, and functionality. This article explores the technical architecture, prompt engineering strategies, and platform compliance steps required to build and launch a successful catholic ai app . Whether you are using Flutter, Swift, or Kotlin, these insights will help you build a robust, secure, and helpful application. Designing a Catholic AI: Aligning with the Catholic Church Stance on AI Before writing a single line of code, developers must understand the domain. Building tools for this community requires respect for established doctrines and traditions. Fortunately, the Vatican has provided clear guidance on this technology. The Catholic Church Stance on AI The Vatican has taken a proactive and surprisingly technical approach to modern computing. Under the leadership of Pope Francis, the Church has introduced the concept of "algorethics"—the ethical development and deployment of algorithms. The catholic church stance on ai emphasizes that technology must always serve human dignity, protect personal privacy, and promote truth. For developers, this means your application must prioritize: Truthfulness: Minimizing errors in theological ou