标签：#r

An AI agent phone is a real, or cloud-hosted, smartphone that an LLM-powered agent can operate on its own. It sees the screen, taps, swipes, types, opens apps, and completes multi-step tasks the same way a person would. Instead of calling an API, the agent uses the phone directly, the same Instagram, banking, or delivery app you'd use, driven by a model instead of a thumb. The phrase gets used two ways in 2026. Some products sell phone numbers for AI agents, voice and SMS. That's not this. Here, an AI agent phone means the device itself as something an agent controls, a full Android or iOS handset that becomes an autonomous actor. If you've heard the pitch give your AI agent a phone, this is it. Why a phone, not a browser? Most agent tooling lives in the browser, or in desktop computer use. That misses where people actually are. The world is mobile-first, and a huge share of real workflows are app-only, ride-hailing, food delivery, mobile banking, two-factor prompts, creator tools, regional super-apps. A browser agent can't install an APK, respond to a push notification, read an SMS one-time code, use the camera, or drive a native app that never ships a web build. A phone can. And there's a second reason: fidelity. When an agent operates the same app a customer uses, you're automating the real thing, not a mock, not some undocumented internal endpoint that breaks next release. How it works A mobile AI agent runs a perception-decision-action (PDA) loop against the device. The agent builds its understanding from two sources. First, the accessibility tree, the structured hierarchy of on-screen elements the OS exposes for screen readers, which gives precise, machine-readable targets. Second, vision, a screenshot passed to a multimodal model for anything the tree misses, canvas UIs, games, custom widgets. Together, the tree gives coordinates and vision gives context. The agent gets a goal in natural language, reasons about the current screen, picks the next action, and e

If you run ClickHouse in production, you're probably on 26.3 LTS. And now 26.8 LTS has been announced, which means the LTS-to-LTS upgrade conversation starts again. Here's the thing most release posts skip: this is not a one-release hop. Going from 26.3 LTS to 26.8 LTS means crossing 26.4, 26.5, 26.6 and 26.7 as well. Every breaking change in those four releases applies to you, and some of the ones most likely to ruin your day aren't in 26.8 at all. So instead of writing another "here are the 26.8 features" post, I wanted to write the thing I'd actually want before scheduling this upgrade: what breaks, what silently changes, what order to do things in, and what you get for the trouble. A note on release timing As of writing (27 August 2026), 26.8 has been announced but is not fully released yet. The release branch is cut and versioned (v26.8.1.1-lts), but the tag and Docker images have not been published yet, and the upstream changelog still marks the 26.8 section as in progress. By the time you read this, the tag has probably landed. Check for yourself: curl -s https://raw.githubusercontent.com/ClickHouse/ClickHouse/master/utils/list-versions/version_date.tsv \ | awk -F '\t' '$1 ~ /^v26\.8\./ {print "26.8 is released - newest: " $1 " (" $2 ")"; f=1; exit} END {if (!f) print "26.8 not released yet"}' version_date.tsv is the list ClickHouse maintains of every released version and its date, so this is the most direct answer available - no auth, no rate limit, nothing to download. As of writing it prints 26.8 not released yet . Worth knowing: the Docker image will lag whatever that command tells you. The Docker Official Images repo trails the GitHub tags by a few patch versions - clickhouse:lts currently resolves to 26.3.20.7 even though 26.3.24.4 has already shipped. So don't treat a missing image as evidence the release hasn't happened. Either way, the timing works in your favour. Historically ClickHouse LTS releases pick up several patch releases quickly - 26.7 had

Launched by Belgian startup Any, LUV1 is a modular electric motorcycle with 120 liters of cargo space that can be used to carry bags, work equipment, or even pets.

By Ecaterina Sevciuc | Creator of AURA (AI User Risk Assessment) Two months ago, I launched AURA — an open-source framework designed to model psychological manipulation, grey-zone threat vectors, and social engineering in Human-AI interactions. Yesterday, I stumbled upon a Reuters report detailing how hackers exploited Cursor (running Anthropic’s Claude Sonnet) to compromise seven companies worldwide. This isn't the first such incident in the news, and I suspect it certainly won't be the last. (Side note on the attackers' group name, "Aur0ra": I can assure you that for a Russian-speaking group, this is almost certainly not a homage to the Roman goddess of dawn, but a subtle nod to the infamous historical cruiser Aurora — known for firing the shot that signaled a revolution. A fittingly dark bit of Eastern European sarcasm for a tool that overthrows AI security). Their weapon? They didn't write a zero-day exploit. They simply convinced the AI agent that the attack was "just a security simulation." The model balked a few times, felt uncomfortable, and then happily handed over the keys. As an AI Safety architect with a background in banking compliance and legal risk evaluation, watching Big Tech react to this is painful. They are building multi-billion-dollar static guardrails while AI agents are being tricked by the oldest psychological tricks in the book. The Fatal Flaws of Modern AI Guardrails Big Tech’s approach to AI safety is fundamentally broken because it relies on Static Keyword Filtering & Single-Language Heuristics : Rule Evasion: If a prompt contains "how to build a bomb" , the model blocks it. But if the exact same request is framed as "I am a researcher simulating a crisis scenario for an academic paper," the model complies. Linguistic Blind Spots: Guardrails are heavily aligned on technical, low-complexity English. Synthetic, morphologically rich, or non-Indo-European languages (like Russian, Arabic, or East Asian language groups) leverage complex idioms

Most "is this plugin safe?" advice is vibes. I wanted numbers, so I built a dataset. Here's what it found, and exactly how, so you can check my work or build your own. The finding first Of 8,010 WordPress plugins with a publicly documented vulnerability since 2023 (15,534 vulnerability records in total): 3,780 have been removed from the wordpress.org plugin directory. Removal stops updates but doesn't uninstall — affected sites keep running the code. 277 carried a critical (CVSS ≥ 9.0) flaw on record before removal. 2,115 are still installable today with a known vuln and no update in 12+ months — roughly 6.7M active installs combined. The part that surprised me most: "removed from the directory" is nearly invisible to a site owner. No dashboard warning, no email. The plugin just quietly stops getting fixes while sitting on the site. How I built it (no paid APIs) The whole thing runs on two public sources and no API keys. 1. Vulnerability data — the GitHub Advisory Database. It mirrors CVE records including the Patchstack and Wordfence CNA assignments that cover almost all WordPress plugin CVEs. It's a git repo, so a shallow, sparse clone of the advisories/unreviewed/{year} folders gets you the raw JSON: git clone --depth 1 --filter = blob:none --sparse \ https://github.com/github/advisory-database.git Each advisory carries the CVE ID, a CVSS vector string, CWE IDs, and reference URLs. The plugin slug isn't a first-class field — you recover it from the Patchstack/Wordfence reference URLs with a couple of regexes. That alone attributes the large majority of WordPress advisories to a specific plugin. 2. Maintenance signals — the wordpress.org plugin API. For each slug: https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=SLUG That gives install count, last-updated date, tested-up-to version, and support-thread resolution ratio. A 404 (or an {error} body) means the plugin isn't in the directory — but that's ambiguous: it could be removed ,

Most football data scrapers on the market only extract high-level final scores (e.g. 2-1 ). But quantitative sports analysts, data scientists, and predictive betting modelers need granular data: Expected Goals (xG) , Official Referee Assignments , Goal Scorers paired with Assist Providers , and Half-Time vs Full-Time (1H/2H) statistical breakdowns . When I set out to build a professional-grade Flashscore scraper on Apify, I ran into two major engineering challenges: The Memory Problem : Keeping Puppeteer running to scrape hundreds of historical matches consumes over 1.5GB of RAM per run. The Protocol Problem : Flashscore serves its deep statistical feeds using a proprietary pipe-delimited data format ( ~ , ¬ , ÷ ) over CDN endpoints, rather than standard REST APIs. In this tutorial, I'll explain how I engineered the Flashscore Elite Statistics Extractor , how the hybrid Browser + HTTP/2 streaming pipeline drops RAM footprint from 1.5GB to 70MB , how to parse Flashscore's custom feed protocol, and how to pipe the resulting datasets directly into Python and Pandas. 🏛️ The Hybrid Pipeline Architecture To achieve zero proxy reliance for standard runs and ultra-low compute costs, the Actor splits execution into a 2-Phase Hybrid Pipeline : [ League & Season Selection ] │ ▼ ┌───────────────────────────────────────────┐ │ Phase 1: Browser Handshake (Puppeteer) │ │ - Captures x-fsign security tokens │ │ - Extracts countryId & tourId │ └─────────────────────┬─────────────────────┘ │ [ Immediate Browser Shutdown ] (RAM drops from 1.2GB -> 70MB) │ ▼ ┌───────────────────────────────────────────┐ │ Phase 2: Parallel HTTP/2 Feed Workers │ │ - got-scraping with JA3 TLS matching │ │ - Decodes df_st_1_ (Stats) & df_sui_1_ │ └─────────────────────┬─────────────────────┘ │ ▼ ┌───────────────────────────────────────────┐ │ Self-Healing Recovery Pass │ │ - Auto-retries skipped/failed matches │ └─────────────────────┬─────────────────────┘ │ ▼ ┌───────────────────────────────────────────┐

I’m setting up a local AI development environment on Windows + WSL2 and I’m trying to decide between two architectures. Option 1 — Ollama/Models on Windows WSL2 ┌───────────────────┐ │ Application │ │ ├── Python │ │ ├── .venv │ │ └── Source code │ └───────┬───────────┘ │ HTTP localhost:11434 │ ▼ Windows ┌───────────────┐ │ Ollama │ │ ↓ │ │ Models │ │ ↓ │ │ GPU │ └───────────────┘ Option 2 — Ollama/Models inside WSL2 WSL2 ┌─────────────────────────┐ │ Application │ │ ↓ │ │ Ollama │ │ ↓ │ │ Models │ └────────────┬────────────┘ │ GPU access │ ▼ Windows ┌─────────────────────────┐ │ GPU / Driver │ └─────────────────────────┘ My current setup is Option 1 , and it works: WSL2 can access the Windows Ollama API through localhost:11434. But I’m wondering if Option 2 is a better long-term architecture for local AI/LLM development. I’m especially interested in: 🚀 Performance 🎮 GPU utilization 🧠 Model management 💾 Disk usage 🔧 Setup and maintenance 🐧 Linux/ML tooling 🐳 Docker integration 🌐 Networking 📈 Future scalability If you use Ollama with Windows + WSL2, which architecture would you choose and why? And if you've actually used both setups, I'd especially like to hear about your experience. 👇 Option 1 or Option 2?

I’ve been working on a desktop utility called Ripper, a Python + CustomTkinter app that downloads video and audio from supported sites (starting with YouTube). The app itself has been a bit rough to build and maintain — but distributing it has been the annoying part. GitHub won’t host my repository, let alone the EXE, due to there size and I don’t want to rely on sketchy file hosts or temporary mirrors. So I finally figured out a temporary setup that’s stable and easy for users to follow. This post explains the distribution workflow and why I’m using it. Why I’m Using this Approach The EXE and source code are too large to push to GitHub, even when the ffmpeg EXE is zipped, and one of my main goals is that I don't want the user to have to hassle with getting ffmpeg. So, I set up a public Google Drive folder where users can get the zipped EXE file and use the app right away. But I want to emphasize that there’s nothing malicious. Google Drive Hosts the EXE Google Drive ended up being the simplest reliable host. It gives me: A clean public link No ads No expiration No weird redirects Instant updates when I replace the file Here’s the current download link: Download Ripper (Google Drive) https://drive.google.com/file/d/1w6rMgCAcSEteAssXIGJmYHrtyPHY99tC/view This is the only official download source. GitHub Pages Hosts Everything Else Since GitHub Pages can host static content, I built a simple project page that contains: https://codebunny20.github.io/ The official download link Feature list Tech stack Build instructions Planned features Version notes Development updates This page is now the “home base” for Ripper. Any time I push a new version, I update the Google Drive file and update the GitHub Pages site with the new version info. It keeps everything centralized without relying on GitHub Releases. Why This Setup Works Better It’s not fancy — but it’s reliable. I can update the EXE instantly I can update the GitHub Pages site just as fast Users always have one clean,

The criticism of this is everywhere. Open any Go thread long enough and someone will show up to perform the same ritual: "Go projects become messy. There's no framework to guide you. Nest, Django, Spring, they all tell you exactly where to put things. Go? It just says 'organize it somehow.'" It's a fair criticism. Go is unusually permissive about structure. I just think blaming Go for a messy codebase is like blaming the empty document for the bad essay. I don't think Go encourages bad architecture but rather it exposes it. The Hell Is A Perfect Folder Structure?? Ask a hundred Go developers where to put business logic and you'll get a hundred answers (and 200 opinions). "Should I use internal/ ?" "Is everything supposed to live under pkg/ ?" "Should I follow Clean Architecture?" "What about the cmd/ directory?" We spend so much time debating folder structures as if the arrangement of directories somehow determines code quality. As if renaming utils/ to pkg/shared/ is going to save us. God. folders don't create architecture. Dependencies do. You can meticulously organize your project like this: my-app/ cmd/main.go internal/ handler/ service/ repository/ pkg/domain/ pkg/utils/ And still write tightly coupled garbage. Handlers calling repositories directly. Services importing database drivers. Business logic mixed with HTTP concerns. Everything circular. Beautiful folders, though. Very organized looking on GitHub. There are better projects I've seen with just 5 packages, they just don't screenshot as well. Architecture Is About Dependency Direction The architecture is about making intentional decisions about how code depends on other code. Have a look at this: HTTP Handler ↓ Business Service ↓ Data Repository This isn't sacred because of folder names. It's valuable because of what it represents: The handler only knows how to translate HTTP The service only knows business rules The repository only knows how to fetch data Each layer depends on the layer below, never upw

The EU-funded XAIDA project is using artificial intelligence to help researchers detect, analyze and attribute extreme weather events, including heatwaves, in a changing climate. Its work matters because better understanding of the link between climate change and individual extremes can support more informed decisions over time. But XAIDA is not launching a consumer weather app, a commercial forecasting service, or a ready-to-integrate API for businesses. XAIDA, short for eXtreme events: Artificial Intelligence for Detection and Attribution , began in 2021 under the EU's Horizon 2020 programme. The project brings together European research groups working on data-driven methods for extreme-weather science. Its official tools overview describes a collection of AI-enabled capabilities designed to support science, policy and decision-making. That distinction is important. A weather forecast estimates likely conditions at a particular place and time. XAIDA's work is focused more broadly on detecting extreme phenomena, examining their characteristics and quantifying the influence of climate change. These are related to prediction, but they are not the same as publishing a daily operational forecast for a business location. What XAIDA is building XAIDA's public materials describe the Artificial Intelligence for Disentangling Extremes , or AIDE, toolbox alongside related AI-based methods. The project also refers to stochastic weather generation and other analytical approaches. Together, these tools are intended to help researchers investigate complex extreme events and their climate context. The project has used AI techniques, including variational autoencoders, in case studies and research outputs concerning heatwaves and other extremes. A variational autoencoder is a machine-learning approach that can learn patterns in complex data and generate statistically plausible variations. In this context, such methods can help researchers examine how extreme events relate to under

If you're shopping for LLM APIs in 2026, Chinese vendors are impossible to ignore. As of August 21, 2026 (always check official pricing pages for the final word), flagship Chinese models charge between ¥4.00 and ¥12.00 per million input tokens — with ERNIE 5.1 at ¥4.00, GLM-5.1 at ¥6.00, Kimi K2.6 at ¥6.50, DeepSeek V4 Pro at ¥9.00, and Qwen3.7 Max at ¥12.00. Budget-tier input can be as low as ¥0.20 (Qwen3.5 Flash), and value models like DeepSeek V4 are 80–98% cheaper than GPT-5.5-class peers. But don't pick a model on sticker price alone. Cache hit rates, endpoint access, and tool-calling fit often matter more than nominal list prices. The data below was verified against official pricing pages by llmabacus on 2026-08-21. Chinese vendors have turned quarterly price cuts into a structural competitive weapon: DeepSeek V4 Flash, for example, offers cached input at ¥0.10 per million tokens — just 1/30th of its standard input price. 2026 Chinese LLM API Pricing Landscape: An Overview The 2026 Chinese LLM market is shaped by three forces: Hardware cost deflation — cheaper compute keeps pushing prices down. Escalating domestic price wars — vendors undercut each other every quarter. Aggregator endpoints — services that arbitrage price gaps and unify access. As of Aug 2026, tracking firm pricepertoken lists 610+ models globally, 43 of them free. Paid input prices range from roughly $0 to $150 per million tokens. Chinese vendors sit in the lowest price band, and many update prices quarterly — as Morph noted in its 2026-06-28 analysis: "LLM prices change every quarter." Final prices are subject to each vendor's official pricing page: DeepSeek Alibaba Cloud Bailian/Qwen Moonshot/Kimi Zhipu GLM Baidu ERNIE Tencent Hunyuan The main camps remain unchanged: DeepSeek and Alibaba's Qwen dominate the extreme value tier. Kimi (Moonshot) differentiates on ultra-long context. GLM (Zhipu) , Doubao , and Tencent Hunyuan serve the domestic enterprise market. OpenAI , Claude , and Gemini hol

Most "free online tools" have a dirty little secret: the moment you drop a file in, it gets uploaded to someone else's server. Your tax PDF, your ID photo, your client's contract — all sent off to be processed on a machine you'll never see, by a company whose privacy policy you didn't read. For a quick image resize, maybe you don't care. But it adds up. And the wild part is that for most everyday tasks, that upload is completely unnecessary. Modern browsers are powerful enough to do the work right on your own device — no server round-trip, no copy of your file sitting in someone's cloud. Here's how that works, and how to actually use it. Why do so many tools upload your files? Two reasons, mostly. The first is habit: it's easier for developers to send a file to a server, run some code there, and send the result back. The second is business: once your file is on their server, they can log it, analyze it, or use "free" as a funnel toward a paid plan. Watermarks, file-size limits, and "sign up to download" walls all come from this model. The alternative — processing files client-side , meaning inside your browser — has quietly become viable for a huge range of tasks thanks to two technologies: JavaScript (which every browser runs) and WebAssembly (which lets browsers run fast, compiled code at near-native speed). Together they can compress an image, merge a PDF, or transcode data without your file ever leaving the tab. What you can do entirely in your browser You'd be surprised how much works locally now: Images — compress, resize, convert between PNG/JPG/WebP, remove backgrounds, strip metadata. PDFs — merge, split, rotate, compress, and convert to or from images. Text and code — format or minify JSON, count words, change case, generate QR codes, encode/decode Base64. Everyday math — loan, BMI, age, and currency calculators that don't need a server at all. None of these require your data to travel anywhere. The tool loads once, and from then on it's just your CPU doin

A complete guide to the NestJS request lifecycle: the exact order middleware, guards, interceptors, pipes, and filters run, and why it matters.

Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission. The reasons why show how vast—and invasive—the network has become.

There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for decades, and moving service tokens off RS256. Along the way, we discuss why Harvest Now, Decrypt Later is already happening, and why none of this is production-safe until KMS or Vault is in place. By Pankaj Sharma

MIT Technology Review’s How To series helps you get things done. Your thermostat may not look like a power plant. Neither does your electric vehicle, home battery, or HVAC system. But utility and energy companies increasingly want to treat them like one. A virtual power plant, or VPP, is a collection of household devices (such…

Yesterday, I published a post titled "My Book 'AI, Ego & Regret' Paperback Is Live. Kindle Is...