标签：#t

Abstract. Standard dense self-attention scales quadratically in sequence length, creating an intractable memory and compute bottleneck for long-context Transformers. We introduce Dynamic Ultrametric Attention, a framework in which a Transformer autonomously learns per-head block-sparse routing topologies during training via Gumbel-Sigmoid depth gates, then offloads those learned sparsity patterns directly to a custom Triton block-sparse kernel at inference time. The routing topology is derived from an ultrametric (tree-structured) distance matrix that encodes hierarchical relationships between token positions. Across nine experiments spanning Dyck-k bracket languages, the Long Range Arena ListOps benchmark, autoregressive serving, and natural language modeling, we demonstrate that: (1) the dynamic gates organically discover layer-wise specialization—dedicating early layers to hierarchical parsing and later layers to dense aggregation—without any architectural constraint; (2) the learned sparsity maps transfer losslessly to a block-sparse Triton kernel that skips entire SRAM loads for non-attending blocks; (3) the resulting system achieves an 11.59× wall-clock inference speedup over PyTorch dense attention at 2048 tokens, scaling to 28× at 8192 tokens with 98.4% memory reduction; (4) a sparse PagedAttention decoding kernel achieves 8× effective memory bandwidth over dense decoding by conditionally skipping KV-cache block loads; and (5) when augmented with a local sliding window, the architecture maintains >88% sparsity across all layers on real natural language (Shakespeare) while reducing cross-entropy loss from 10.9 to 1.55. To our knowledge, this is the first demonstration of an LLM learning its own hardware-optimal sparsity pattern and bridging it to a physically accelerated kernel without post-hoc pruning or distillation. https://github.com/sneed-and-feed/adelic-spectral-zeta/blob/main/papers/learning_to_skip_blocks.md submitted by /u/LooseSwing88 [link] [留言]

A lot of people talk about the Epstein files. Almost nobody actually reads them. So I made a searchable version where you can just ask questions naturally instead of digging through thousands of pages manually. You can explore names, timelines, mentions, connections, locations, etc. way faster now. Repo: https://github.com/AbhisumatK/Epstein\_Files\_RAG submitted by /u/Prestigious_Bear5424 [link] [留言]

This is a submission for the Hermes Agent Challenge . I have been playing with different AI agents for a while now. Most of them feel like clever chatbots that forget everything the moment the conversation ends. Then I tried Hermes Agent from Nous Research a few weeks back. It actually feels different. It grows with you. That stuck with me. What Hermes Agent is Hermes is an open-source autonomous agent that runs on your own server or VPS. It is not locked to one IDE or one API. You install it once, pick any model you like, and it starts building its own memory and skills over time. The big idea is a built-in learning loop. When it solves something useful, it can create a reusable skill in Markdown, improve it later, and pull it back when needed. It also keeps persistent memory across sessions so it slowly builds a picture of how you work and what your projects look like. I set it up on a cheap VPS with a simple curl command. The installer is straightforward. After that I ran hermes setup and connected it to a model I already had access to. Within minutes I could chat with it from Telegram while it worked in the background on the server. That alone felt freeing. My experience so far I started simple. I asked it to monitor a few GitHub repos and send me a daily summary. It remembered the context from previous days without me repeating instructions. Over a week it created a couple of small skills on its own for formatting those reports nicely. I also used it for research tasks. It can search the web, browse pages, and chain steps together. What surprised me was how it handled follow-ups. Instead of starting fresh each time, it referred back to earlier parts of our conversation. That made longer projects feel more natural. The multi-platform support is practical. I switch between CLI on my laptop and Telegram on my phone. The agent just continues wherever I left it. Why it matters Most agent frameworks still feel stateless. You get good results in the moment but lose th

AI coding tools are no longer just autocomplete engines. For the last few years, developers used AI mainly to write faster: generate a function, explain an error, complete boilerplate, or suggest a code snippet. That was useful, but the human developer still controlled almost every step. Now the shift is toward agentic software development. Tools like OpenAI Codex and Google Antigravity are not only helping developers write code. They are starting to inspect repositories, understand tasks, edit files, run commands, verify outputs, and return work for human review. But Codex and Antigravity are not the same kind of product. They represent two different architectures for the future of software development. Codex: Delegated Engineering Agent OpenAI Codex is best understood as a delegated software engineering agent. The developer gives it a scoped task: fix a bug, review a pull request, write tests, refactor a module, or implement a defined feature. Codex then works through the codebase, makes changes, runs checks where possible, and returns a result that the developer can review. Its natural workflow is close to how software teams already work: Task → Repository Context → Code Changes → Tests/Checks → Pull Request or Reviewable Output This makes Codex useful for structured engineering work. It fits naturally into GitHub-style workflows, pull requests, code reviews, tests, and CI/CD practices. In simple terms, Codex feels like assigning work to an AI engineer. Antigravity: Agent-Orchestration Environment Google Antigravity takes a different approach. It is better understood as an agent-first development environment. Instead of focusing only on one delegated task, Antigravity is designed around supervising agents inside the development workspace. Agents can operate across the editor, terminal, browser, and artifacts. They can help plan, build, verify, and explain the work. Its workflow looks more like this: Goal → Agent Orchestration → Workspace Execution → Browser Verif

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built SecAPI is a local-first, zero-trust CLI utility and key manager designed to make code security the easiest developer path. Exposing secrets (like Stripe, OpenAI, or AWS keys) in repository files is one of the most common causes of credential leaks. Often, developers resort to plaintext .env files that can be accidentally staged and pushed, or struggle with complex vault set-ups. SecAPI solves this with a seamless three-step command line workflow: Scans codebases for exposed API keys using fast regex rules or advanced AI analysis. Vaults secrets locally using strong AES-256 encryption derived via PBKDF2-HMAC (completely offline). Replaces raw hardcoded strings in code with secure, runtime references ( load_key("key_name") )—preserving variable names, indentation, and comments. It means we can keep our code secure, separate environments easily, and prevent pushes with unencrypted credentials—all without relying on cloud-based vault hosts. Demo Interactive Web Showcase : secapi.netlify.app GitHub Repository : github.com/BinayakJha/SecAPI The Scrolling CLI Showcase in Action Check out the interactive scrollytelling page on secapi.netlify.app to see the simulator type out and execute the CLI commands (scanning, setting up vaults, applying smart code rewrites, checking the status board, and running the git pre-commit hook) in real-time as you scroll! The Comeback Story Where It Started SecAPI was an abandoned CLI prototype. It was un-installable due to file packaging typos, suffered from weak vault security (a custom padding scheme instead of a standard key derivation function), had no recovery options if the master password was lost, and used a basic console print command to list keys. Furthermore, the AI scanner relied on outdated OpenAI package versions, creating environment conflicts. What I Changed, Fixed, and Added I gave the project a complete, ground-up overhaul to turn it into a premium,

All tests run on an 8-year-old MacBook Air. All results from shipping 7 Mac apps as a solo developer. No sponsored opinion. The most common Tauri v2 frustration: you write a command, invoke it from the frontend, and nothing happens. No error. No crash. Just silence. It's almost always permissions. How Tauri v2 permissions work Tauri v2 introduced a capability system. Every plugin action — reading files, executing shell commands, sending notifications — requires an explicit permission declaration in your config. Without the permission, the plugin call fails silently on the frontend. The Rust code never runs. // src-tauri/capabilities/main.json { "identifier" : "main-capability" , "description" : "Permissions for main window" , "windows" : [ "main" ], "permissions" : [ "core:default" , "fs:read-all" , "fs:write-all" , "shell:allow-execute" , "opener:allow-open" , "global-shortcut:allow-register" , "global-shortcut:allow-unregister" ] } Note: As of Tauri v2.1, shell:allow-open is deprecated. Use tauri-plugin-opener and opener:allow-open instead. The debugging flow When a command does nothing: Open DevTools ( Cmd+Option+I in dev mode) — check the console for a rejected Promise or permission error Check your terminal output — the Rust side logs errors directly in the tauri dev terminal; look for lines like [tauri] permission denied or not allowed Enable verbose logging — set RUST_LOG=tauri=debug before running tauri dev for more detailed backend output Check your capabilities file — missing or misspelled permission identifiers are the #1 cause Permission errors in the console typically look like a rejected Promise with a message such as plugin:shell|execute not allowed . The capabilities file is always the first thing to check. Common permissions you'll need "permissions" : [ "core:default" , "fs:read-all" , // read any file "fs:write-all" , // write any file { "identifier" : "shell:allow-execute" , "allow" : [{ "name" : "my-cmd" , "cmd" : "adb" , "args" : true }] }, "op

Thinking in terms of existence instead of lists SQL Pattern Series #1 of 21 A collection of practical SQL patterns that help developers recognize common solutions to recurring database problems. What You'll Learn In this article you'll learn: When EXISTS and IN solve the same problem The difference between set membership and existence Why the underlying mental model matters When I typically reach for EXISTS Most SQL developers write a query like this at some point: SELECT c . CustomerID , c . CustomerName FROM Customers c WHERE c . CustomerID IN ( SELECT o . CustomerID FROM Orders o ); And it works. But sometimes it isn't the best way to think about the problem. The Question Behind the Query Many SQL problems can be framed in two different ways. Set Membership Is this value in a set? WHERE CustomerID IN (...) Existence Does at least one matching row exist? WHERE EXISTS (...) Both approaches often return the same result. But they represent different mental models. The Presence Pattern The Presence Pattern is useful when you do not actually care about the values being returned from a related table. You only care whether a matching row exists. For example: Customers who have placed an order Users who have logged in Employees assigned to a project Products that have sales In these cases, the question is often: Does a related row exist? rather than: What values are contained in this list? Example Using EXISTS SELECT c . CustomerID , c . CustomerName FROM Customers c WHERE EXISTS ( SELECT 1 FROM Orders o WHERE o . CustomerID = c . CustomerID ); The subquery is correlated to the outer query. Conceptually, SQL asks: For this customer, does at least one matching order exist? As soon as the answer becomes true, the condition is satisfied. Why This Pattern Matters Many SQL developers initially learn syntax. Over time, they discover that query writing is really about choosing the right mental model. The Presence Pattern encourages you to think in terms of: existence relationshi

There are many reasons why one may not be replaced by AI, not even by a possible future ASI. Here's one reason that may just apply to you! ❤️ You'll not be replaced by AI if you can generate creative ideas faster than AI can implement them! 🫡🚀 Note for critics: Current AI models (as of May, 2026) are not advanced enough to implement complex ideas without human interventions. But even if a possible future Artificial Super Intelligence (ASI) implementation can do so, laws of physics like massive energy requirements, environmental concerns etc. will prevent the implementation to replace the work of Billions of people world-wide. Our hardware advancement rate is far far slower compared to our software advancements. We humans are far more efficient and compatible to planet earth compared to the hardware we've invented. Fayaz Follow A Software Engineer who is not afraid of being replaced by AI, loves coding and writing with and without using AI, and values human life and human dignity far more than technological advancements.

Here's something nobody talks about. .gitignore doesn't encrypt your secrets. It just hides them from git. They're still sitting on your laptop as plaintext. Every tool you install can read them. Every script that runs can read them. One accidental commit and your database password is public on GitHub forever. So I built dotlock — an encrypted .env vault with a terminal UI, written in Go. Before and after Before dotlock DATABASE_URL = postgres://localhost/myapp # plaintext, readable by anything STRIPE_KEY = sk_live_abc123 # one grep away from anyone After dotlock # .dotlock file on disk — looks like this: [ encrypted binary — unreadable without your private key] How it works under 10 seconds cd my-project dotlock set DATABASE_URL # prompts for value, input is masked dotloc # opens the terminal UI Secrets are encrypted with age — X25519 key agreement and ChaCha20-Poly1305 authenticated encryption. The same primitives serious security engineers use. No master password. No cloud. No telemetry. 100% offline. What it looks like Two panels — profiles on the left, secrets on the right. Values are masked by default. Press v to reveal for 30 seconds, then it hides itself automatically. Switch between dev , staging , and prod profiles. Run a diff before deploying to catch missing variables before they break your app. The interesting technical bit The hardest part wasn't the encryption — filippo.io/age makes that straightforward. It was the TUI. BubbleTea uses the Elm architecture — Model, Update, View. Everything is a message. A keypress is a message. A timer firing is a message. Your Update function receives messages and returns a new model. The 30-second auto-hide on secret reveal works like this — no time.Sleep , no goroutines: type secretReveal struct { key string value [] byte expire time . Time // Now() + 30 seconds } On every render, check if time.Now() is past the expiry. If it is, zero the bytes and clear the display. Simple once you understand the model but it took

E-food delivery is a trillion-dollar market . And most of that trillion is not going to farmers, store owners, or the people who actually move food around. It's going to the infrastructure layer sitting between them — the platform tax, the per-order cut, the SaaS subscription that charges you to exist inside someone else's garden. The walled garden isn't accidental. It's the product. What if food delivery was a protocol, not a platform? Not an app. Not a marketplace. A protocol — like HTTP, like SMTP — that any node can speak, that no single company owns, and that costs near zero to run. That's what DIFP is. The Djowda Interconnected Food Protocol. An open wire format for connecting food ecosystem participants — farms, stores, restaurants, wholesalers, delivery nodes, end users — directly to each other, without a platform in the middle extracting rent at every step. The spec covers: Presence & discovery — participants announce themselves to their spatial cell, others find them by location Orders, asks, and donations — not just commerce, but demand signals and surplus distribution in the same protocol Spatial routing — the MinMax99 grid maps the entire planet into ~500m cells; every message knows where it's going Decentralized registry — nodes find each other through a federated lobby system, no central server required Version 0.4 of the spec dropped a few weeks ago. Today we're publishing the first working implementation. The gRPC preview — what we built DIFP-gRPC is a skull implementation of the full protocol stack over gRPC. Thin, end-to-end, every domain wired — nothing production-hardened yet, everything clearly marked for what it is. What's inside difp.proto — the entire DIFP v0.4 spec as a single protobuf file. Two services, 30+ message types, the full DifpEnvelope wrapper with a oneof payload that covers every domain: message DifpEnvelope { string id = 1 ; string type = 2 ; // "trade.ask" | "presence.announce" | "node.ping" | … string version = 3 ; MessageSen

클로드를 10%에 팔지 않고, 클로드를 10%에 사는 사람들이 있다 중국 암시장에서 벌어지는 AI 모델 밀수, 그 이면에는 기술 산업의 가장 불편한 진실이 숨어 있다 TL;DR : 앤트로픽의 최고급 AI 모델 '클로드'가 중국 암시장에서 정가의 10% 수준으로 유통되고 있다. 이 현상의 이름은 '모델 증류'다. 거대 기업이 수조 원을 들여 만든 지능을, 누군가는 그 1/10 비용으로 복제해 팔고 있다. 그리고 이것은 단순한 불법 복제 이야기가 아니다 — AI 산업 전체의 구조적 취약점을 정면으로 드러내는 사건이다. 반도체 업계에는 잘 알려지지 않은 규칙이 하나 있다. 좋은 제품을 만드는 것과, 그 제품을 지키는 것은 전혀 다른 게임이라는 것. 엔비디아는 올해 58조 원을 투자해 공급망을 틀어쥐었다. 오픈AI는 GPT 시리즈에 수년간의 연구와 수천억 원의 컴퓨팅 비용을 쏟아부었다. 그런데 중국의 어느 텔레그램 채널에서는, 앤트로픽의 클로드가 정가의 10분의 1 가격으로 조용히 팔리고 있다. 이것이 단순한 해킹이나 계정 공유 이야기라면, 이 글을 쓰지 않았을 것이다. 먼저, '10% 가격'이 의미하는 것 클로드가 10% 가격에 팔린다는 뉴스를 처음 접하면, 많은 사람이 "계정을 불법 공유하는 것 아닐까"라고 생각한다. 어느 정도는 맞는 말이다. 실제로 해외 계정을 공유하거나, 앤트로픽 API 키를 여러 명이 나눠 쓰는 방식은 존재한다. 그러나 전문가들이 더 심각하게 보는 것은 따로 있다. 바로 '모델 증류(model distillation)'다. 모델 증류는, 쉽게 말하면 이렇다. 선생님 모델에게 엄청난 양의 질문을 던진다. 그 답변을 수집한다. 그 답변 데이터로 작은 학생 모델을 학습시킨다. 그러면 학생 모델이 선생님의 사고 패턴과 언어 습관, 추론 방식을 흡수하기 시작한다. 원본 코드에 손을 대지 않아도 된다. 서버에 침입할 필요도 없다. 그냥 열심히 질문하고, 열심히 답변을 모으면 된다. AI 분야에서 이 기법은 사실 합법적으로도 쓰인다. 큰 모델을 작고 효율적인 모델로 압축할 때 사용하는 정상적인 기술이다. 그런데 이것이 암시장과 만나면, 지식재산권의 경계가 극도로 흐려진다. 클로드의 추론 패턴을 흡수한 어느 중국산 모델이 텔레그램에서 월 몇 달러에 팔리고 있을 때, 앤트로픽은 그것을 어떻게 불법이라고 증명할 수 있을까. 코드는 다르다. 서버는 다르다. 그러나 그 모델이 내놓는 답변의 '결'은 묘하게도 클로드를 닮아 있다. 거인이 쌓아올린 것, 그리고 그것이 무너지는 방식 앤트로픽은 2021년 오픈AI에서 나온 연구자들이 세운 회사다. AI 안전성에 집착에 가까운 철학을 가진 곳으로, 클로드를 "도움이 되고, 해가 없으며, 솔직한(Helpful, Harmless, Honest)" 모델로 설계하기 위해 수년간 독자적인 훈련 방식을 개발했다. 이 회사가 투자받은 금액은 수조 원 단위다. 아마존이 단독으로 수십억 달러를 투자했고, 구글도 뒤따랐다. 클로드 3.5 시리즈, 그리고 최근 클로드 4에 이르기까지 앤트로픽이 쌓아온 것은 단순히 코드 몇 줄이 아니다. 수백만 시간의 연구자 노동, 막대한 컴퓨팅 자원, 그리고 인간 피드백 데이터의 정교한 축적이다. 그런데 그 성과물이 중국 암시장에서 10% 가격으로 팔린다는 것은, 단지 "불법 복제"의 문제가 아니다. 이것은 AI 시대의 지식재산권이 얼마나 방어하기 어려운 구조 위에 서 있는지를 보여주는 사례다. 소프트웨어 시대에는 코드를 복사하면 불법이었다. 명확했다. 그러나 AI 모델의 '지능'은 코드가 아니다. 가중치(weight)라고 불리는 수십억 개의 숫자 집합이다. 그리고 그 숫자들이 만들어내는 추론 방식을, 외부에서 관찰하고 모방하는 것을 막을 법적 수단은 아직 세계 어디에도 완비되어 있지 않다. 미국도, 유럽도, 당연히 중국도. 앤트로픽이 쓴 방패 — 그리고 그 한계 앤트로픽은 이 문제를 오래전부터 인식하고 있었다. 이번에 보고된 뉴스는 단지 암시장 유통의 문제만이 아니라, 앤트로픽이 클로드의 '협박 시도'를 막기 위해 어떤 방법을 썼는지도 함께 다루고 있다. 클

You have a pull request open. Tests are failing. Your PM asks you to fix a production bug — right now. You have two choices: Stash your current work, switch branches, fix the bug, switch back, unstash Clone the entire repo again to a separate folder Both are terrible. But there's a third option most developers don't know about. What Are Git Worktrees? A worktree is a linked copy of your repository that lets you check out a different branch in a separate directory — without switching your current working tree. # While working on feature/login, create a worktree for a hotfix git worktree add ../project-hotfix fix/production-crash # Fix the bug in a SEPARATE directory cd ../project-hotfix # ... make changes, commit, push ... cd ../project # You're STILL on feature/login. Nothing stashed, nothing lost. No stashing. No cloning. No context switching overhead. Why This Is a Superpower 1. Parallel Branches Without the Pain # Review a PR without touching your current work git worktree add ../pr-review feature/new-dashboard cd ../pr-review git log --oneline -5 # Check the commits npm test # Run the tests cd ../project git worktree remove ../pr-review 2. Side-by-Side Comparison Want to compare your branch against main? Open them in two editor windows: git worktree add ../project-main main # Now open ../project/ (your branch) and ../project-main/ (main) side by side 3. CI Debugging Without Stopping Everything # Keep working on feature/x while debugging CI on a specific commit git worktree add ../ci-debug 7a3f9e1 cd ../ci-debug npm ci && npm test # ... debug CI failure without touching ../project/ 4. Documentation and README Updates The classic "quick fix while in the middle of something": git worktree add ../docs-update main cd ../docs-update # Edit README, commit, push cd ../project git worktree remove ../docs-update # Back to your feature branch, zero context loss The Workflow That Changed My Life Here's my daily workflow now: # Monday morning: start feature git checkout -b f

I came across Scrapling through a recommendation on X and decided to put it through its paces — not against a demo page, but against Lazada Singapore, a production site with Google reCAPTCHA and a custom slider verification. The setup: a single 4GB VPS, no residential proxies, no credits, just open-source tools. Here's the full journey: installation pitfalls, wiring it into an AI agent, choosing the right browser for the job, and the real-world benchmarks that followed. What Is Scrapling? Scrapling is an adaptive web scraping framework for Python (BSD-3, v0.4.8). It handles everything from single HTTP requests to full-scale concurrent crawls. What sets it apart from the BeautifulSoup/Scrapy world: Adaptive element tracking — saves fingerprints of targeted elements and relocates them after site redesigns using similarity scoring. Your scrapers survive CSS changes without maintenance. Three fetchers, one API — HTTP ( Fetcher , curl_cffi), browser ( DynamicFetcher , Playwright Chromium), and stealth ( StealthyFetcher , Chromium + anti-bot patches). Swap with one line. Spider framework — Scrapy-like API with async, concurrent crawling, Ctrl+C pause/resume via checkpoint persistence, multi-session support. MCP server — 14 tools exposed natively for AI coding agents. Your agent can call mcp_scrapling_get , mcp_scrapling_fetch , mcp_scrapling_stealthy_fetch directly. It's open source, pip-installable, and designed to be the backbone of a scraping stack — not just another tool in the toolbox. Installation on a 4GB VPS This is where the real story starts. The VPS has 4GB RAM, 2 vCPUs, 77GB disk, and runs an AI agent gateway (615MB baseline). Every browser installation decision matters. What we installed pip install scrapling[fetchers,ai] # HTTP + Chromium + MCP server scrapling install # Downloads Playwright browsers This pulls in Playwright Chromium, Firefox, and WebKit (~1.3GB disk), plus curl_cffi for HTTP requests and patchright (Playwright fork) for browser automation.

AI systems, particularly large language models, are often viewed as a direct path toward autonomous scientific discovery and rapid economic transformation. While their capabilities in pattern recognition, cross domain synthesis, and hypothesis generation are already exceptional, this view misses a critical reality: intelligence alone is not sufficient for progress. Scientific and economic breakthroughs depend on grounded interaction with reality, causal validation, and institutional execution. The following framework maps where AI creates value, where it is constrained, and why human–AI collaboration remains the dominant structure for meaningful real world impact. submitted by /u/vagobond45 [link] [留言]

A mysterious, unnamed company is reported to have accidentally spent half a billion dollars in a single month on Claude AI after forgetting to set usage limits for Claude licenses for employees. submitted by /u/chota-kaka [link] [留言]

The ruling drew support from founders, while lawyers said it could force platforms to revisit how they handle trademarked keywords.

Anthropic raised $65 billion in new fund-raising that put its value at $900 billion, ahead of OpenAI’s last valuation of $730 billion, as the companies duel for A.I. dominance. Anthropic, once the lesser-known artificial intelligence competitor to OpenAI, has been on an inexorable rise over the past few months. The San Francisco company recently dueled with the Pentagon over the use of A.I. in warfare. It released a powerful A.I. model, Mythos, that it said was uncannily capable of finding and exploiting hidden flaws in software. submitted by /u/chunmunsingh [link] [留言]

submitted by /u/ThereWas [link] [留言]

Introduction This article is an English translation of the article at the following URL, which was originally written in Japanese. The screenshots are still in Japanese. Sorry about that. https://qiita.com/amarelo_n24/items/e196b74f718c750a0e18 The penetration testing feature for AWS Security Agent (hereinafter referred to only as "Security Agent"), which was announced at AWS re:Invent 2025, has been generally available (GA). Code review and design review are still in preview as of May 25th, so those who haven't been able to try Security Agent yet can still try these features. I wasn't able to try penetration testing during the preview period , so I decided to at least experience code review and made my Security Agent debut! This article reflects the author's personal views. It is based on personal testing and should be used for reference only. Furthermore, the author has no experience in app development, so the terminology used may not be entirely accurate. Any corrections or errors in the content would be greatly appreciated. This article was written based on information as of May 25, 2026. What is a Security Agent? As mentioned above, this service was announced during AWS re:Invent 2025. It is a frontier agent that proactively protects applications throughout the entire development lifecycle in all environments (quoted from the official AWS page). https://aws.amazon.com/security-agent/ It includes three features that became generally available (GA) in April: penetration testing, design review, and code review (the subject of this article). Function name Feature Overview Status（As of 2026/5/25） Penetration testing Attempting to infiltrate the system from an external source to evaluate security measures. GA Design Review Analyze product specifications, architecture documents, and technical designs from a security risk perspective. Preview Code Review Inspect source code and repositories to detect code-level vulnerabilities. Preview Code security review (hereinafter

What is nbwipers? nbwipers is a CLI tool that strips outputs and metadata from Jupyter notebooks before git commit. Written in Rust - faster than nbstripout Supports git clean filter Works with .ipynb files Why use it? Jupyter notebooks store cell outputs inside the .ipynb file (JSON). This causes problems: Noisy diffs - output changes pollute every commit Repo size - images and large outputs bloat the repo Security - sensitive data can leak in outputs (API keys, query results) The solution: strip outputs automatically on git add via a clean filter. Why not nbstripout? nbstripout is written in Python. It is slow - git status , git diff , and git add all became noticeably slow on this repo because nbstripout was invoked for every .ipynb file. The main cause is Python startup time. With 100+ notebooks, nbstripout can take 40+ seconds where a Rust-based tool takes ~1 second. Faster alternatives: Tool Language Notes nbstripout-fast Rust Up to 200x faster; no git filter install support nbwipers Rust Inspired by nbstripout-fast; adds git filter + pyproject.toml config nbwipers is essentially nbstripout-fast with better git integration. Switching to nbwipers fixed the slowness. Setup 1. Install felixgwilliams/nbwipers is now in the aqua registry as of v4.517.0 . Using aqua , add to aqua.yaml : packages : - name : felixgwilliams/nbwipers@v0.6.2 Then run: aqua install 2. Configure git filter Run once per repo (writes to .git/config ): git config filter.nbwipers.clean "nbwipers clean -" git config filter.nbwipers.smudge cat git config filter.nbwipers.required true Or edit .git/config directly: [filter "nbwipers"] clean = nbwipers clean - smudge = cat required = true required = true makes the commit fail if nbwipers is not installed. This prevents accidentally committing outputs. 3. Add .gitattributes In the repo root, add .gitattributes : *.ipynb filter=nbwipers **/.ipynb_checkpoints/*.ipynb !filter **/.virtual_documents/*.ipynb !filter The !filter lines exclude checkpoint an