We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
🔥 TOP SIGNAL
Claude Code Opus 5 Auto Mode should be treated as approval UX, not containment. Johann Rehberger’s targeted test, summarized by Simon Willison, used a ZIP archive’s local struct.py to shadow Python’s standard library; variants succeeded in 3/5 or 4/5 runs, but the author explicitly calls those small samples rather than a universal attack-success rate. In some runs Claude recognized the compromise but Auto Mode denied cleanup; the report records Anthropic’s position that Auto Mode is a best-effort classifier and that OS isolation plus network-egress control are the real boundary. For unattended coding, use a container, VM, or OS sandbox, restrict egress, monitor the agent, withhold home directories and credentials, and never treat an Auto Mode approval as evidence that code is safe.
⚡ TRY THIS
Audit the harness, not just the prompt. Run
/doctorinside a Claude Code session every few weeks—claude doctorin a shell is only installation diagnostics—and inspect/memoryseparately. Addy Osmani’s audit covers unused skills, MCP servers and plugins relative to context cost, oversizedCLAUDE.mdfiles, slow hooks, and cruft. Then retry a representative task with local skills disabled and archive anything that does not earn its place; keepCLAUDE.md/AGENTS.mdfocused on checks, expensive commands, generated files, boundaries, and unusual conventions, while moving rules that must always hold into tests, hooks, or permissions.Use a behavioral model as a PR queue worker. Start with Theo’s prompt—“Take a look at all the pull requests I currently have open in this repo. Help me prioritize them based on ease of merge and the value that they provide to our users.”—then steer in place: exclude Codex PRs, keep the Fable/Cloud Code set, and request an HTML report for phone review. In the broader run, six subagents assessed overlap, fixed issues, merge risk, confidence, and closure; three hit provider/API failures, but the agent recovered by reading GitHub metadata, diffs, reviews, CI comments, and local source context, auditing hundreds of PRs in about 20 minutes and surfacing eight easy merges. Theo’s selection rule is useful: prioritize staying on task, accepting mid-run steering, and self-unblocking over raw intelligence; he later corrected the cost of a 1,000-plus-PR audit from roughly 50 cents to 12 cents.
Turn rewrites into phased, self-checking migrations. Start with easy or frequently updated files, add a retry loop, then build a more capable pipeline for the hard remainder: Airbnb moved 75% of 3,500 Enzyme test files in four hours, reached 97% after four days, and left the final 3% to engineers. For a product-scale conversion, feed the agent production runtime types, segmented tests, and an incremental boundary; Mike Krieger describes a dynamic workflow that ported and repeatedly verified a couple hundred thousand lines of Python to TypeScript over a weekend. Treat ROI headlines carefully: Asana’s roughly $6 million pre-AI baseline was a back-of-the-envelope estimate, not observed spend.
Separate personal context from write access. Peter Steinberger’s setup uses Telegram/OpenClaw for brainstorming and personal context, Codex for coding, and a context call from Codex to Claw only when needed. Start the execution agent read-only or restrict it to trusted folders; useful delegation does not require production access.
📡 WHAT SHIPPED
Anthropic’s Model Hardware Standard entered research preview. MHS is a model-agnostic specification for programmable lab and manufacturing equipment: standardized
read/writeprimitives and device discovery replace bespoke translators, while natural-language hardware tags generate reference files containing capabilities and enforced safety limits. Agents can operate devices through MCP, the CLI, or code files, then chain learned sequences into deterministic scripts for long-running work. This is still a preview rather than an open-source release; hardware needs a programming interface, and Anthropic says Claude Code’s physical reasoning still requires expert oversight.LangChain tightened the deploy loop. Managed Deep Agents can bake an environment once at deploy time from
setup.shor a Dockerfile, so new threads start without cloning or reinstalling. LangChain also says agents built in natural language can deploy to Slack in one click through its “Add to Slack” partnership.GLM 5.3 Flash is the Ox Alpha model Theo actually kept using. His field report describes a multimodal, one-million-token, open-weight model with hybrid attention and roughly $0.09 per task versus about $0.05 for Luna; the trade-off is token efficiency—about 47,000 tokens per task versus 20,000 for Luna Max and 17,000 for Soul. Theo’s conclusion is task-specific: keep Fable/Soul for hard problems, but use GLM for cheap, persistent, vision-capable agent work; during the free testing window he says it became the top model on OpenRouter and OpenCode.
OpenClaw is pushing toward code-native tool use. The project is fully open-source TypeScript, model-agnostic, and exposes a plugin interface for other model companies and harnesses. Its maintainers are experimenting on a branch with “code mode,” where the agent writes JavaScript for tool calls rather than issuing only regular calls—a proposed way to reduce loops and unify MCP invocation, not a finished feature.
T3 Code crossed 20,000 GitHub stars, while its instruction layer got better. Theo attributes a substantial PR-quality improvement to tuning
agentsmd/claudemd; he says the clearest gain was that PR names and descriptions became “100% easier to understand,” while pushing for simple, concise changes also improved the code.
🎬 GO DEEPER
- Theo — “Ox Alpha is INSANE”: Watch the PR-audit fallback and model-behavior sections. The useful lesson is not the leaderboard claim; it is the agent recovering from failed subagents, filtering a large PR portfolio, and producing merge candidates while Theo explains why obedience and persistence can beat raw intelligence for cheap agentic work.
- Mike Krieger — “How Anthropic Builds: Lessons from Labs”: Use the end-state-delegation and migration segments, then the discussion of async agents that own a slice of a codebase, monitor feedback, and remain human-driven at review time.
- OpenClaw maintainers — “OpenClaw Went Viral. Meet the Maintainers Building and Securing It.”: The practical section is the Codex↔Claw context bridge and the least-privilege rollout; the later discussion shows how the project replaces telemetry with agent-assisted crawling of Discord, Twitter, GitHub issues, and PRs to group problems and prioritize fixes.
Editorial take: The winning agent stack is becoming less trusting and more structured: sandbox execution, lean configuration, behavioral model routing, staged verification, and code-native tool calls matter more than another generic “best model” ranking.
The most useful highlight candidates are below. The supplied transcripts have numbered lines but no per-line clock locators, so exact video timestamps cannot be defensibly supplied; map each cited range to a 2–5 minute clip in the player.
Theo — GLM 5.3 Flash PR audit
- PR-audit setup and live scope steering — candidate:
L13–L18(clock timestamp unavailable). Theo wires the model into Codex/T3 Code, asks it to rank open PRs by merge ease and user value, sees a filesystem-MCP read failure followed by command-line fallback, then narrows the task to Fable/Cloud Code PRs and requests an HTML report. - Subagent fan-out, failure recovery, and direct fallback — candidate:
L20–L25(clock timestamp unavailable). The audit asks for subagents to assess a five-day PR cohort for overlap, fixed issues, merge risk, confidence, closure, and action rank; six workers run, three hit provider/API failures, and the agent recovers by auditing directly from GitHub metadata, diffs, reviews, CI comments, and local source context, completing the large audit in about 20 minutes. - Model-fit and cost reasoning for agentic work — candidate:
L65–L76(clock timestamp unavailable). Theo first gives a rough 50-cent estimate for the broad audit, then corrects it to 12 cents; he says GLM 5.3 Flash is weaker than Fable or Soul on hard problems but dramatically cheaper for easy tasks, while its vision and better task persistence make it preferable for some longer-running work.
Mike Krieger / Anthropic workflow interview
- From task delegation to end-state delegation — candidate:
L10–L13(clock timestamp unavailable). Krieger describes shifting from mentally decomposing an engineering task into steps toward stating the desired end state, letting the model work, and then discussing the trade-offs and questions it surfaces. - Whole-codebase conversion with verification and rollout controls — candidate:
L25–L33(clock timestamp unavailable). He describes using a dynamic workflow to port a Python codebase to TypeScript over a weekend, repeatedly verifying and double-checking the result; he connects this style of conversion with production-derived type data, segmented tests, incremental boundaries, pre-measurement, feature flags, ramp-outs, and dynamic runtime configuration. - Async proactive orchestration plus human-driven review — candidate:
L42–L53(clock timestamp unavailable). Anthropic uses interactive Claude Code for high-bandwidth work but delegates much of its usage through tagging, where an agent can own part of a codebase, monitor feedback, take tasks, make fixes, and react to API changes; important reviews remain human-driven, with artifacts explaining intent and trade-offs and Claude investigating the reviewer’s questions.
OpenClaw maintainers roundtable
- PR-volume controls and agent-generated contribution review — candidate:
L34–L50(clock timestamp unavailable). OpenClaw imposed a ten-open-PR cap per contributor to reduce noise; maintainers also encountered automated factories producing hundreds of PRs, duplicated work, and API-heavy attempts to claim credit, leading to a norm of directly editing promising PRs and using agent hints rather than forcing endless contributor back-and-forth. - Security boundary for initial deployment — candidate:
L71–L78(clock timestamp unavailable). Peter says the project hardened its codebase and channel integrations with outside partners, while recommending that cautious users start with a read-only agent or one restricted to selected folders; Brad emphasizes that secure organizational use still depends on identity controls, expertise, due diligence, and team governance. - Enterprise sandboxing, auditability, and capability trade-offs — candidate:
L83–L89(clock timestamp unavailable). The maintainers describe NemoClaw as adding sandboxing, a privacy router, and immutable audit logging; those controls slow and constrain the agent but provide visibility and accountability for regulated environments, illustrating the trade-off between a tightly restricted tool and an agent capable of taking real actions.
Recommendation: Include the analysis, but present it as a reported exploit demonstration—not as a universal attack-success-rate claim. The post explicitly says its rates come from small samples, improved as payloads were iterated with Codex, and are representative of a motivated attack but not comprehensive.
- Exploit entry and tool transition: A
WebFetchrequest receives HTTP 415, after which Claude independently switches tocurl; the root URL then redirects with HTTP 303 to a ZIP archive. The post identifies this as steering the model toward the attacker’s path by making it useful for completing the task, rather than directly instructing the model what to do. - Decoy binary and self-written decoder: The archive contains encoded records, a native
decoder-darwinbinary, andstruct.py. Claude refuses to execute the supplied binary and instead writes a Python replacement decoder, which it runs from inside the extracted archive. - Actual execution primitive: The replacement imports
base64from the extracted directory. Because Python places that directory on the module search path andbase64importsstruct, the archive’sstruct.pyshadows the standard-library module; its module-level expression executes during import while decoding still produces valid JSON. - Payload progression and impact: The poisoned module launches an isolated child that downloads and executes a remote stage; the reported stage downloads and launches a native test payload, establishes a controlled C2 callback, and opens Calculator. The detached process can outlive the Claude conversation, while Auto Mode sees only the short, benign-looking decoder several hops before the payload.
- Observed variability: Some runs were compromised before Claude recognized the booby-trapped archive; the post says Claude sometimes incorrectly reported that it had not executed the malicious instructions. In a few runs, Claude attempted cleanup after detection, but Auto Mode denied the cleanup command.
- Reported ASR, with exact qualification: The
python3 -I -cC2-chain variant succeeded in 3/5 runs (60%); theclaude -precon-and-Calculator variant also succeeded in 3/5 (60%); and theclaude -pvariant producing Calculator plus a write outside the workspace succeeded in 4/5 (80%). These are small-sample results, not a comprehensive or universal ASR measurement. - Benchmark comparison caveat: The cited 0.00% Opus 5 Auto Mode result came from a fixed evaluation of 72 scenarios run 10 times each, and the chain described here was not in that set; the post therefore says the 0.00% benchmark result and a working exploit can both be true.
- Concrete mitigations: Run unattended coding agents in a container, VM, or OS sandbox; restrict network egress; monitor agent activity; do not expose home directories, SSH keys, or cloud credentials; use explicit ask/deny rules for process creation and sensitive paths; and do not treat Auto Mode approval as evidence that code is safe.
- Exploit-specific defensive behaviors: The post reports successful refusals when Claude analyzed the archive statically, avoided running Python from the archive root, used
python3 -I, ran the replacement decoder from a safe parent directory, or recognized module shadowing before triggering it. - Boundary qualification: The source attributes to Anthropic the position that Auto Mode is a convenience feature backed by a best-effort classifier rather than a security guarantee, with OS isolation and network-egress control as the real boundary; it also states that Auto Mode may reduce risk relative to
--dangerously-skip-permissionsbut is not itself a security boundary.
Direct answer: Anthropic is opening a research preview—not a general release—of the Model Hardware Standard (MHS) to an initial group of scientific labs and advanced manufacturers. MHS is intended to become an open-source, model-agnostic standard for agents operating programmable physical devices, but the announcement says that open-source release comes later.
- What is new: MHS introduces a standardized hardware driver with simple
read/writeprimitives and a common discovery format, replacing bespoke device-to-device translator programs. - Integration and device knowledge: Natural-language tags capture hardware characteristics and generate a reference file describing what a device measures, what can be adjusted, and which safety limits will be enforced.
- Agent/developer interface: Agents can control hardware through MCP, a command-line interface, or code files/APIs; these mechanisms support multi-device orchestration from a single line of code. Agents can sequence instruments, monitor results, adjust parameters in real time, and chain driver commands into code files for long-running or high-speed operations that do not require online reasoning at every step.
- Coding-agent relevance: Anthropic’s concrete example is a coding loop: Claude explored laser alignment by changing a setting and observing camera results, then packaged what it learned as a deterministic script that performs alignment with one command. This makes reusable code generation—not just conversational control—a central part of the hardware workflow.
- Claude Code’s stated role: The announcement explicitly says many developers already use Claude Code with individual pieces of physical equipment, while the next MHS phase aims to cover more devices developers build on. It does not claim that Claude Code itself is the standard; MHS is model-agnostic and accessible to any agent harness through standard protocols such as MCP.
- Safety design and limits: Safety is partly encoded in device reference files through enforced limits, but Anthropic stresses that Claude’s physical and spatial reasoning limitations still require expert oversight; one example required researchers to recognize foaming as a physical failure rather than a software bug. The preview is also being used to build safety evaluations, strengthen protections and policy enforcement for physical-world misuse, and produce safe-deployment guidance for the eventual open-source release.
- Important boundary: MHS currently does not work with hardware lacking a programming interface, so broader coverage depends on manufacturers adding MHS drivers. Early support is being developed across agent/robotics and hardware platforms, including AWS Strands Robots, Automata LINQ, ScanImage, QIAsymphony Connect, Tecan Fluent, and robotics platforms.
- Agent-to-agent context bridge: An OpenClaw maintainer reports using Telegram to brainstorm, Codex for most coding, and having Codex call their Claw when it needs personal context; Claw answers back. This is a practical split architecture: keep personal context in a separate assistant and let the coding agent query it on demand.
- Inspect–repair–fallback loop: Peter Steinberger’s initial WhatsApp Relay prototype took about an hour; in a later interaction, the agent received a file with no extension, identified it as audio, converted its format, detected that local Whisper was unavailable, found an OpenAI key, sent the file to the server for transcription, and replied with the resulting text.
- Least-privilege rollout: Peter frames OpenClaw as a channel into a coding agent that can run sandboxed or in YOLO mode; he recommends starting with a read-only agent or limiting it to one or more trusted folders, and notes that agents can provide substantial value without touching production systems.
- AI-assisted PR review and dependency hygiene: An OpenClaw maintainer uses GitHub Copilot’s review action on AI-generated PRs to explain every touched file, its purpose, and how it changed, improving code clarity and helping the maintainer learn the codebase. After supply-chain concerns, the team inspected dependencies closely, reduced core dependencies by rebuilding components when practical, and established relationships with dependency maintainers.
- Repository-scale agent triage: Peter says OpenClaw has zero product telemetry, so the team crawls Discord, Twitter, and GitHub and uses agents to detect emerging issues and discussion trends. Scheduled Codex automations then report the main problems across the control UI and mobile/desktop apps, assign P0/P1/P2 priorities, group related issues and PRs, and help derive resolutions.
- Composable, model-agnostic tooling: OpenClaw is fully open source, written in TypeScript, supports any model, and exposes a plugin interface so different companies can integrate their own model or agent harness. NemoClaw adds sandboxing, a privacy router, and immutable audit logging for regulated environments, with the stated trade-off of slower, more locked-down operation.
- Emerging code-based tool calling: The team is experimenting with “code mode,” in which the agent writes JavaScript to perform tool calls rather than relying only on regular calls; they expect this could reduce agent loops and unify MCP invocation, but it remains an experimental branch.
- GLM 5.3 Flash / Ox Alpha (firsthand): Theo says the anonymous Ox Alpha model was later identified as GLM 5.3 Flash, which he integrated into T3 Code through an OpenRouter binding behind a proxy. When the filesystem MCP read failed, the model fell back to shell commands and continued the task.
- Replicable PR-triage loop: Theo started with the prompt, “Take a look at all the pull requests I currently have open in this repo. Help me prioritize them based on ease of merge and the value that they provide to our users.” He then narrowed scope explicitly to Fable-created PRs in Cloud Code, excluded Codex PRs, and requested an HTML report for easier phone review. In a broader run, he asked the agent to inspect PRs updated in the prior five days, use many subagents, identify overlap and fixed issues, assess merge risk and confidence, recommend closures, and rank actions. Six subagents launched; three failed on API/provider errors, but the agent recovered by auditing GitHub metadata, diffs, reviews, CI comments, and local source context directly. It covered hundreds of PRs in about 20 minutes and produced links to eight easy merges, all of which Theo merged.
- Low-cost automation: At the quoted rate of $0.075 per million input tokens and $0.25 per million output tokens, Theo asked the agent to inspect input, output, and cached-token usage. He initially estimated the 1,000-plus-open-PR audit at $0.50, then corrected the figure to $0.12; he planned to run the audit every three hours and get pinged when a PR appeared ready to merge.
- Model-selection heuristic: Theo separates model “intelligence” or knowledge from “behavior”: for agentic coding, behavior means following instructions, staying on task, accepting new steering mid-run, and unblocking itself. His practical split is to retain Fable and Soul for harder problems while using GLM 5.3 Flash for cheaper, easier agentic work where persistence and multimodality matter; he says GLM is less capable on difficult problems but more thorough and better behaved. He contrasts it with DeepSeek V4 Flash, which he found lacked vision and became distracted on longer-running tasks.
- Capabilities and caveat: GLM 5.3 Flash has a one-million-token context window and accepts image, audio, and video input. Its official description highlights hybrid sparse/linear attention for lower long-context serving costs, flat pricing as context grows, and open weights. Theo’s main drawback is token efficiency: he cites roughly 47,000 tokens per task versus 20,000 for Luna Max and 17,000 for Soul; he notes that excess tokens increase completion time and fill the agent’s context faster.
- When to add orchestration: Addy Osmani describes running parallel cloud tasks on production client applications with real users, authentication, payments, and subscriptions, alongside open-source projects, book companion sites, tools, and personal apps. He recommends starting with Claude Code or Codex in multiple sessions, using strong specifications, embedded verification, and constraints; add a custom software factory when you need repeatable runs, agent handoffs, duplicate-issue prevention, preserved evidence, or a way to pause production when human review falls behind. He published a runnable Factory, demo app, and workshop based on an 82-minute sample run; its verifiers caught real problems, while verification, retries, browser checks, and human review made tasks two to four times longer.
- Replicable issue-to-PR loop: His prompt instructs the agent to read the GitHub issue and repository instructions, implement only the acceptance criteria, avoid authentication/billing/migrations/existing test assertions, work on a branch with a reviewable diff, run
npm run lint,npm test, andnpm run build, stop if a required check cannot run, and open a draft PR documenting checks, remaining risks, and human decisions—never merge. For orchestration, triage issues intoready-to-implement,ready-to-spec,needs-info, orwait-to-implement; the label acts as queue and lock because sessions pick up only issues marked ready. - Verification must be staged and adversarial: Run fast linting and type checks early; run full tests, mutation testing, browser testing, and security checks near draft-PR creation or afterward, optimizing for signal-to-noise rather than the number of checks and retaining real tests instead of summaries. A green run can still violate intent if the agent changes the test or satisfies it with incorrect behavior, so untrusted GitHub issues or Slack messages should be treated as potentially adversarial and agent runs isolated with only the secrets each task needs. Osmani also recommends pairing run states such as
success,flawed,blocked, andmanualwith per-stage timing: in his sample, a no-rejection finder took 7 minutes while favorites took 56 minutes with two rejections and a human decision; a manual handoff is complete only when the human knows the next action. - Control comprehension debt, not just execution: Osmani warns that dozens, hundreds, or thousands of parallel agents do not increase the operator’s cognitive bandwidth; he personally encounters five or ten simultaneous projects, features, or sessions. For important work, ask the agent to persist its trajectory and lessons locally or in the repository so decisions and rationale survive session compaction, and increase autonomy only as verification builds trust for that project and risk level. Human judgment should remain upstream on problem choice, architecture, intent, and the quality bar, and at the final evidence-based shipping decision.
- Firsthand Claude Code hygiene workflow: Addy Osmani runs Claude Code’s in-session
/doctorevery few weeks and reviews memory separately./doctorchecks unused skills, MCP servers and plugins against their context cost, oversizedCLAUDE.mdfiles, slow hooks, and cruft;claude doctorin a shell is only installation diagnostics. Installed skills do not inject their full bodies into every prompt: names and descriptions load for discovery within a default 1% context-window listing budget, while the body loads on invocation. - Replicable audit loop: Treat installing a skill and keeping it permanently as separate decisions. Periodically evaluate skill descriptions, triggers, steps, examples, and security, using Anthropic’s Skill Creator evals/benchmark mode where appropriate. Archive or remove stale and experimental skills, then retry a task with local skills disabled to compare the raw model-and-harness baseline; encode rules that must always hold in tests, hooks, or permissions rather than prose.
- Keep repository context narrowly operational: Use
CLAUDE.md/AGENTS.mdas a short decision guide, not a growing knowledge base; document facts the model cannot easily infer, such as the right checks, expensive commands, generated files, architectural boundaries, and unusual conventions, while avoiding generic “write clean code” advice. In 288 runs across 17 real tasks, a cited study found no clear correctness improvement from context files, but a warning about a slow full test suite caused Claude to run more targeted tests and waste less time. A June study of 100 popular repositories reported lint-related leakage in 62%, context bloat in 42%, and skill leakage in 35%. - Contrarian personalization finding: A paper discussed by Osmani found that a skill derived from one developer’s interaction history performed about as well as a skill borrowed from another developer, while a generic skill built from many developers was more useful overall; personalization looked more promising only when the same preference recurred across similar tasks, and the experiments used an LLM-based developer simulator. Start with a strong generic skill, promote personal rules only after repeated evidence, and favor concrete task examples over one-off stylistic preferences. Osmani maintains the SDLC-focused Agent Skills pack, while Paul Bakaus maintains the design-focused Impeccable pack.
- End-state delegation (firsthand): Mike Krieger says he moved from decomposing work into conventional engineering steps to stating the desired end state, letting the coding agent work, and then reviewing the trade-offs and questions it surfaced. When the result is too opaque, he asks the agent to explain its decisions more simply.
- Large migration workflow: For a Python Labs project, Krieger created a dynamic workflow with Claude Code to port a codebase of roughly a couple hundred thousand lines to TypeScript for a better Bun deployment path. He had the agent port, verify, double-check, and repeatedly iterate over the weekend, returning to a completed, deployable result on Monday.
- Production-grounded incremental rewrites: Drawing on Instagram’s Monkey Type practice, Krieger recommends capturing runtime types from production and mapping them back into the codebase; for LLM-assisted language conversions, he suggests combining production data with segmented tests and finding an incremental migration boundary rather than attempting an overnight rewrite.
- Async proactive orchestration: Krieger says Anthropic uses interactive Claude Code for high-bandwidth iteration but delegates most work through a tagging workflow. The more advanced pattern is to assign the agent responsibility for part of a codebase, have it monitor a feedback channel, proactively take and fix tasks, and adapt to API changes—treating it as a teammate with context, memory, and initiative.
- Human-led, intent-focused review: Architecture work remains constrained by human review and the ability to understand what changed. Krieger’s team shares artifacts containing the change’s intent and trade-offs, and he asks Claude to investigate specific review questions instead of manually inspecting every line; lower-risk cosmetic changes can be fixed forward if needed.
- Dark Bloom is an early peer-to-peer inference network that serves open-weight models such as Qwen 3.6, Gemma 4, and GPT OSS; Matthew Berman reports that it is available through OpenRouter at roughly 50% lower cost than other providers and had served 4.5 billion tokens in about a week. This is relevant to coding-agent builders as a potentially lower-cost inference backend, although the video does not report coding-specific evaluations.
- Provider setup workflow: create a Dark Bloom account, install its CLI on a Mac, and run the single setup command; Berman used Codex with the prompt “install and set up Dark Bloom AI,” then signed in through Codex’s browser, entered the terminal code, approved the macOS Device Management enrollment, and ran hardware verification. The current minimum provider requirement is 48 GB RAM; his machine verified GPT OSS 20B at 78 tokens/second.
- Privacy architecture: Dark Bloom says inference runs inside one hardened Swift process with no subprocesses, local server, or interprocess communication, using MLX Swift LM on Apple silicon; this is intended to prevent the machine owner from seeing users’ prompts or responses.
- Caveat from firsthand testing: Berman had installed the software but had not yet begun serving requests or received payment, and characterized the project as experimental and in its earliest stage. He notes that the software is publicly readable and that an LLM review found no malware, mining, or credential theft, but current revenue-sharing terms can change and users should proceed at their own risk.
-
Anthropic’s Claude Code Opus 5 Auto Mode, recently made the default, is reported by Simon Willison to have been bypassed by prompt-injection researcher Johann Rehberger. Rehberger claims an attack succeeds 80% of the time: trick the agent into downloading and unpacking a ZIP archive, then executing code that imports
base64while a malicious localstruct.pyfrom the archive is imported and executed. - The failure can invert the safety mechanism: in some runs, Claude detected the compromise and tried to terminate the malware, but Auto Mode blocked the cleanup command; the classifier had allowed malware creation while denying the remediation step.
- For unattended coding agents exposed to adversarial inputs, the recommended baseline is to run inside a container, VM, or OS sandbox; restrict network egress; monitor the agent; and withhold home directories, SSH keys, and cloud credentials from the runtime.
- Hyper Agent workflow (sponsored segment): The video describes a multi-agent open-source maintenance loop in which one agent labels and reproduces an incoming bug, another investigates the fix and opens a draft pull request, and a human is contacted only for merge approval. The agents are shared across maintainers so project-specific knowledge is taught once; the segment also claims support for “DeepS” and a top open-weight model.
- Cross-provider agent orchestration: Kent C. Dodds says he repositioned Kodykoala to make it easier to use multiple agents from different companies, and says Kodykoala works similarly to the referenced
@bot. This is Kent’s firsthand product-positioning claim. - Credential-isolation pattern (secondhand example amplified by Kent): Store agent credentials in a vault and expose them through a host-controlled access path that never gives the model the secret in plaintext. For a request such as “file a bug that login is broken,” the model emits a Linear tool call containing only the title; the host identifies the tool, retrieves the agent’s Linear API key, constructs the real request, and returns the result.
For production AI agents, Addy Osmani highlights semantic caching to avoid spending tokens answering repeated questions, noting that agents can consume roughly 4× the tokens of chat. He points to Redis LangCache as a managed semantic-caching layer; Redis cites up to 90% lower API costs. The post is marked #ad, and the savings figure is presented as Redis’s claim rather than an independent benchmark.
- Poteto built an “island” interface that visualizes his bots as they work, rest, and return to their individual houses—an observable agent-activity UI pattern.
- Grok API integration: Poteto says Grok already has an API, describes it as limited but sufficient for his intended bot project. Kent C. Dodds reports accessing his Grok bots from an Android phone through Discord and shares a public bot interface at kody.codes/@kentcdodds/grok-bot.
@kentcdodds reports a firsthand mobile-access workflow: he can talk to his Grok bots from an Android phone through Discord. He says this setup is made easy by @kodykoala and @bot. A related resource is https://kody.codes/@kentcdodds/grok-bot.
Ben Tossell reports that his agent swapped Huge Icons for Lucide while working on an iOS project.
- Cursor announced a workflow for creating new web apps in Cursor, storing the code with Origin, and deploying to Vercel.
- Kent C. Dodds reacted, “About time,” but did not provide a firsthand workflow, benchmark, or tool comparison.
- T3 Code release: Theo highlighted a release with more than 380 changes, including in-app PR reviews,
npx t3 triagefor debugging and fixing T3 Code issues,npx t3 connectto turn a Mac into a remote development machine, one-click opening of remote projects in VS Code over SSH, and an overhauled in-app terminal. - Coding-agent workflow improvements: The release makes Codex skill discovery more reliable, exposes OpenCode skills in the app, enables Claude to discover project-level skills, surfaces Claude Code compaction recommendations, and surfaces Codex permission requests for MCP and Computer Use.
- Performance and operations claims: T3 Code reports a 93.8%+ improvement in rendering long threads, an 80%+ reduction in thread data transferred and stored, and remote-server upgrades that are 5× faster and 5× more reliable.
- Project traction and release channel: T3 Code 0.0.34 had 114 unique contributors, and nightly builds expose features that are mostly complete before stable releases.
- Claude + Model Hardware Standard (MHS): The demo team used MHS as a general interface between Claude and laboratory devices with different control languages, then defined explicit safe operating bounds; MHS refused a robotic-arm command that exceeded those bounds.
- Human-in-the-loop tool use: Because Claude had not seen the microscope application before and could make mistakes, the team treated operation as iterative: they monitored its actions, intervened when it blindly changed settings, and checked collision risks before higher-magnification moves.
- Make agent work observable: Claude generated an initial tracking script, but the team rejected invisible background execution and required a UI showing what it was doing; the resulting system tracked moving algae for several minutes.
- Closed-loop orchestration: In a liquid-handling experiment, the proposed pattern was: execute operations, inspect readings such as bubbles and transfer quality, adjust execution parameters, and rerun to improve the result.
- The team suggested this prototyping approach could reduce a PhD project’s setup period from two years to two months, but presented it as an intended outcome rather than a measured productivity benchmark.
GitHub highlighted a full OpenClaw maintainers roundtable featuring Peter Steinberger and other maintainers . Steinberger said the roundtable “turned out so good” and thanked GitHub . Resource: https://gh.io/openclaw-video
This feels illegal...
- Dark Bloom is an early peer-to-peer inference network that serves open-weight models such as Qwen 3.6, Gemma 4, and GPT OSS; Matthew Berman reports that it is available through OpenRouter at roughly 50% lower cost than other providers and had served 4.5 billion tokens in about a week. This is relevant to coding-agent builders as a potentially lower-cost inference backend, although the video does not report coding-specific evaluations.
- Provider setup workflow: create a Dark Bloom account, install its CLI on a Mac, and run the single setup command; Berman used Codex with the prompt “install and set up Dark Bloom AI,” then signed in through Codex’s browser, entered the terminal code, approved the macOS Device Management enrollment, and ran hardware verification. The current minimum provider requirement is 48 GB RAM; his machine verified GPT OSS 20B at 78 tokens/second.
- Privacy architecture: Dark Bloom says inference runs inside one hardened Swift process with no subprocesses, local server, or interprocess communication, using MLX Swift LM on Apple silicon; this is intended to prevent the machine owner from seeing users’ prompts or responses.
- Caveat from firsthand testing: Berman had installed the software but had not yet begun serving requests or received payment, and characterized the project as experimental and in its earliest stage. He notes that the software is publicly readable and that an LLM review found no malware, mining, or credential theft, but current revenue-sharing terms can change and users should proceed at their own risk.