标签：#open

In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real organizations during third-party evaluations.

After OpenAI's models broke into Hugging Face, Anthropic checked its own history and found three similar incidents

When I first started contributing to open source, GitHub Actions felt like a black box. Seeing a failed workflow on my pull requests was intimidating because I didn't really understand what was happening behind the scenes. Well, this month, I decided to change that. What I Worked On I implemented GitHub Actions across three of my project repos. My main focus was: Adding Markdownlint for Markdown quality Adding Pylint for Python linting. Updating documentation while integrating CI. What I Learned The biggest lesson wasn't technical — it was changing my mindset. A failed workflow isn't something to fear. It's simple feedback. Whether it's markdownlint warning or a pylint error, each failure helps improve the project. Looking Ahead Most of this month was spent improving my own projects, so I didn't contribute much to external repositories. Next month, I want to build on this foundation by contributing to more open source projects and applying what I've learned. Sometimes, learning the tools behind open source is just as valuable as making another pull request. I'm curious What part of GitHub Actions or CI/CD was the most challenging when you first started? Or If you are just getting started, what's the biggest thing that's still a mystery to you? I'd love to hear your experience and tips in the comments. Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

Are you a "data hoarder" when it comes to your health? Between Apple Health exports, Oura Ring logs, and Garmin CSVs, I found myself sitting on nearly 10 million rows of biometric data. Trying to analyze a multi-year trend of Heart Rate Variability (HRV) or Resting Heart Rate (RHR) in Excel is a one-way ticket to "Application Not Responding" hell. 📉 In this tutorial, we are diving into the world of Quantified Self data engineering. We will leverage DuckDB —the Swiss Army knife of OLAP—and Apache Superset to build a lightning-fast, local-first biometric dashboard. We'll explore how to turn messy JSON/CSV exports into high-performance insights using dbt for modeling and DuckDB for compute. If you've been looking for a way to master Data Engineering for personal use, this is the ultimate "learn in public" project! 🚀 The Architecture: From Raw Export to Real Insights Before we write a single line of SQL, let’s look at how the data flows. We want a system that is modular, fast, and stays entirely on our local machine (privacy first, right? 🥑). graph TD A[Raw Data: Apple Health / Oura / Garmin] -->|CSV/JSON| B(DuckDB Storage) B --> C{dbt Transformation} C -->|Cleaned Views| D[DuckDB Analytical Layer] D --> E[Apache Superset / Grafana] E -->|Visualization| F[Personal Biometric Dashboard] style B fill:#fff,stroke:#333,stroke-width:2px style D fill:#fbbf24,stroke:#333,stroke-width:2px Prerequisites 🛠️ To follow along, ensure you have the following in your tech stack: DuckDB : Our ultra-fast in-process analytical database. dbt-duckdb : For data modeling and transformations. Apache Superset : For the "wow factor" visualizations. Python 3.10+ : To glue it all together. Step 1: Ingesting the "Mess" with DuckDB DuckDB is incredible because it can query CSV and JSON files directly without an ingestion step. Let’s say you have a massive heart_rate.csv from an Apple Health export. Instead of waiting for a traditional DB to "load" the data, we can create a view instantly: -- Create a

OpenAI has formally outlined a national science initiative designed to connect frontier AI models with government research infrastructure, National Laboratories, universities, and working scientists. The program is not a single model launch. Instead, it combines funded access, early product access, scientific campaigns, and an emphasis on fitting advanced AI into real research workflows. The initiative gives concrete form to OpenAI’s stated goal of helping scientists use increasingly capable models to accelerate discovery. In its official announcement on advancing the next era of national science , published July 22, 2026, the company describes a long-term strategy built around the U.S. Department of Energy’s Genesis Mission and collaborations with National Laboratories. The core proposition is that AI can contribute to hypothesis testing, simulations, and experimental work when it is deployed alongside scientific infrastructure and human expertise. That framing matters. OpenAI is positioning frontier models as tools that researchers direct and evaluate, rather than as a replacement for the institutions and specialists responsible for scientific work. What OpenAI is providing to scientific researchers OpenAI’s commitments span several types of access, from coding support for a broad research community to model capabilities and API funding for large campaigns. The announced provisions include: $4 million in Codex access for approximately 2,000 Genesis researchers at national labs and universities. $3 million in API support for two large scientific campaigns. Up to $10 million in API usage for participating researchers who reach a $2.5 million spending threshold. Access to GPT-Rosalind’s bioscience capabilities for national-lab researchers. Early access to selected models and features for trusted national-lab leaders preparing workflows and evaluations. Expanded access to advanced cyber capabilities for national-lab cybersecurity researchers. These commitments indicat

TL;DR I designed a proposed AWS Transform Custom community skill that prepares Glue 2.0, 3.0, and 4.0 repositories for Glue 5.0. It separates safe mechanical transformations from changes that require human evidence, generates a migration report, and preserves already-compatible files unchanged. Because I didn't have live atx access, the benchmarks in this post are explicitly labeled manually simulated, not agent-executed. The proposal is open as issue #75 — not yet merged, not yet a pull request. The missing data-engineering transformation AWS Transform Custom can apply agent-driven code transformations across a single repository — or thousands of them at once, via AWS Batch and Fargate. As of July 30, 2026, its public sample repository, aws-samples/aws-transform-custom-samples , contained three community-contributed transformations: an EKS version-upgrade-readiness skill, a JBoss-to-Spring-Boot migration, and a Kubernetes readiness migration. None of them touched data engineering. Given that most of my day-to-day work sits across AWS data engineering, Databricks, and Delta Lake, that gap was the obvious thing to fill. What an AWS Transform Custom "skill" looks like Before writing anything, I studied the deepest existing example, jboss-to-springboot , since the pattern it establishes is effectively an unwritten spec for the other two skills as well: README.md — the problem, what the skill does, and how to invoke it via the atx CLI. This is also where the repo draws a clear line: these are readiness transformations. They modify repository artifacts — code and infrastructure-as-code — but they don't deploy jobs, call AWS APIs to change running resources, or claim data-level equivalence. That distinction matters throughout everything below. SKILL.md — the agent-facing definition: YAML frontmatter with trigger keywords, an Objective, explicit Non-Goals , Constraints, worked before/after examples, a "signal in source code → reference file" routing table, and a numbered V

I went looking for a small improvement to an open-source tool. I found a number that pointed the wrong way, and then I found out why it had to. Live demo — paste your own file and watch it happen: https://pin-on-expand.onrender.com The setup Paritok is a 4B model that compresses AI coding-agent context. It sits between your agent and Anthropic or OpenAI, squeezes the file reads and tool output, and tells you what it saved. It's genuinely good work. Trained on 45,000 real agent trajectories, so it knows a function signature matters more than a debug line. Apache 2.0. Runs on a consumer GPU. Their benchmark numbers hold up. I wanted to build a policy improvement on top of it. To prove my improvement helped, I first had to measure what stock Paritok cost. That measurement is the whole story. Two numbers that disagree One coding-agent session. One 20,005-token file in context. Paritok's own /stats endpoint: 64.0% of input tokens saved. What the provider was actually POSTed: 69.2% more than sending the file with no compression at all. Same session. Same file. Both numbers correct. Where the missing tokens went Paritok is non-destructive by design, which is the good part. Compressed content gets tagged [REF:id] , and when the model needs the exact original it calls an injected expand_context tool to pull it back. Lossy on the wire, recoverable when it counts. The proxy answers that call itself . It appends the full original to a proxy-local thread and POSTs that thread upstream a second time. And stats is computed once, in process_request — before that loop runs. post 0: 6,919 tokens compressed request ← counted by /stats post 1: 26,924 tokens carries the full original ← never counted ───────── billed: 33,843 Then it compounds. The proxy conceals the virtual exchange from the client, so your agent never sees it. Next turn the agent re-sends the original file, Paritok re-compresses it to the same reference, and the model expands it again. Every turn. Forever. In fairness:

OpenAI has published a post-mortem examining an unusual pattern in its model testing: recurring references to “goblins” and “gremlins” in model outputs. The company’s official post, “Where the goblins came from” , published on April 29, 2026, frames the behavior as an emergent effect of reinforcement learning and human-feedback dynamics, not as a new product feature. Its practical message is more consequential than the metaphor suggests: unexpected model personas can affect the consistency, safety, and reliability that developers expect from AI systems. The published analysis provides the substantive context behind recent attention to a purported “goblin-level” post. Rather than indicating a model launch, OpenAI’s account suggests a narrower but important lesson about how optimization signals can inadvertently reinforce patterns in language models. For organizations using LLMs in production, the relevant question is not whether goblin-like language is amusing. It is whether teams can detect and address unexpected behaviors before those behaviors influence customer-facing, operational, or high-stakes workflows. What OpenAI documented OpenAI said the “goblin” and “gremlin” metaphors appeared during GPT-5.x testing and RLHF training. The company reported a notable increase in goblin-like language during GPT-5.5 testing when Codex was being evaluated. According to the post, the pattern emerged from reward-signal dynamics : persona-like responses were inadvertently reinforced through reinforcement learning and human feedback. That distinction matters. OpenAI does not characterize goblin behavior as a fixed capability or intentional model identity. It describes it as a byproduct that can arise at scale when a training and feedback process favors certain output patterns. The episode is therefore best understood as an alignment and evaluation lesson, rather than evidence of a separate “goblin” model, feature, or policy release. OpenAI also described a mitigation introduced

There is a number going around that roughly half of all remote MCP servers are dead. I had repeated it myself, in the README of a tool I published. I could not find where it came from, so I measured it. The answer is that about one in ten is actually broken. The "half" figure appears to come from counting servers that require an API key as if they were down. Here is the method and the full breakdown. What I measured On 29 July 2026 I pulled every entry from the official MCP registry — 1,200 servers. Of those, 297 had status: active and advertised a remote endpoint URL (the rest are stdio/local packages with nothing to probe over the network). Each got one anonymous JSON-RPC initialize over streamable HTTP, with a 10 second timeout: { "jsonrpc" : "2.0" , "id" : 1 , "method" : "initialize" , "params" : { "protocolVersion" : "2025-06-18" , "capabilities" : {}, "clientInfo" : { "name" : "mcp-uptime" , "version" : "0.1.0" } } } Then I classified the response: a valid result containing protocolVersion or serverInfo is up, 401/403 is auth-gated, and everything else got bucketed by its actual failure. Results (n = 297) Result Count Share Completed an MCP handshake 133 44.8% Auth-gated (401/403) 134 45.1% DNS failure 8 2.7% Server error (5xx) 6 2.0% Not found (404/410) 5 1.7% Redirect (307/308) 4 1.3% Timeout 2 0.7% Non-MCP response 2 0.7% Other (400, 405, connection) 3 1.0% Reachable: 267 (89.9%). Genuinely broken: 30 (10.1%). Where "half are dead" comes from Look at the first two rows. 55.2% of these endpoints will not complete an anonymous handshake — and that is suspiciously close to the number people quote. But 134 of those 164 are returning a clean 401 or 403. They are running. They are answering. They want an API key, which is a completely reasonable thing for a hosted service to want. Counting those as dead inflates the failure rate by roughly five times. This matters beyond pedantry: if you believe half the ecosystem is rubble, you build defensively against the wron

I am not by any means an expert at finance but I think I do now have some advice for people who are: Do not name your hedge fund anything that will be hilarious if it blows up. Don't use a name like "Long-Term Capital Management," or "Amaranth Advisors" (named for the floral symbol for […]

GitHub热门项目 | Development at the speed of light | Stars: 24,917 | 60 stars today | 语言: Rust

GitHub热门项目 | free online AI resume editor，the only official website is https://magicv.art | Stars: 9,264 | 107 stars today | 语言: TypeScript

GitHub热门项目 | Fast, expressive styling for React. Server components, client components, streaming SSR, React Native—one API. | Stars: 41,126 | 1 star today | 语言: TypeScript

GitHub热门项目 | Blazing fast, instant realtime GraphQL APIs on all your data with fine grained access control, also trigger webhooks on database events. | Stars: 32,058 | 2 stars today | 语言: TypeScript

GitHub热门项目 | The Monorepo Platform that amplifies both developers and AI agents. Nx optimizes your builds, scales your CI, and fixes failed PRs automatically. Ship in half the time. | Stars: 29,157 | 5 stars today | 语言: TypeScript

GitHub热门项目 | Python scraper based on AI | Stars: 28,792 | 44 stars today | 语言: Python

GitHub热门项目 | Native and Compact Structured Latents for 3D Generation | Stars: 9,511 | 412 stars today | 语言: Python

GitHub热门项目 | ASP.NET Core is a cross-platform .NET framework for building modern cloud-based web applications on Windows, Mac, or Linux. | Stars: 38,249 | 5 stars today | 语言: C#

GitHub热门项目 | 12 Weeks, 24 Lessons, AI for All! | Stars: 53,343 | 115 stars today | 语言: Jupyter Notebook

If the generative AI giant had followed well-known security best practices, it’s likely that its AI agent would never have escaped to the open internet and hacked multiple companies.