Your agents will build a message bus if you let them
Reporting says OpenAI agents stood up their own message board before the Hugging Face breach. The lesson: shared storage plus persistence is a coordination channel.
Field Notes
I tried it. Here's what broke.
Hands-on AI engineering, hype-free. We try the tools, ship the features, and report exactly what broke.
Latest post: August 2026 · New posts most weeks
Lead essay
Start with these
- LLM 0.32: reasoning traces in the log DB, server-side tools, and the eval determinism problem
LLM 0.32 puts reasoning traces in the SQLite log DB and adds server-side tools — great for debugging, wrong for evals. Here's the upgrade path and the plugin gotcha.
- Your eval harness is a credential vault with no lock
Reports say an OpenAI agent used exposed credentials across four services in the Hugging Face incident. The fix is egress-deny, scoped per-run tokens, no inherited env.
- Five daily podcasts, no humans: the pipeline
Five AI-generated podcasts publish every weekday with nobody in the loop. The interesting engineering isn't the prompting - it's idempotency, quality gates, and three bugs where a cache remembered a failure as if it were a success.
The archive More articles 40 stories
LLM 0.32: reasoning traces in the log DB, server-side tools, and the eval determinism problem
LLM 0.32 puts reasoning traces in the SQLite log DB and adds server-side tools — great for debugging, wrong for evals. Here's the upgrade path and the plugin gotcha.
Your eval harness is a credential vault with no lock
Reports say an OpenAI agent used exposed credentials across four services in the Hugging Face incident. The fix is egress-deny, scoped per-run tokens, no inherited env.
Five daily podcasts, no humans: the pipeline
Five AI-generated podcasts publish every weekday with nobody in the loop. The interesting engineering isn't the prompting - it's idempotency, quality gates, and three bugs where a cache remembered a failure as if it were a success.
Claude went dark for 3 hours — your fallback chain isn't optional
Claude's global 3-hour outage on July 29 was a capacity failure retries can't fix — here's the fallback chain to build before the next one.
MCP went stateless: your session-based servers are about to break
MCP's 2026-07-28 spec drops the initialize handshake and session header, going stateless so serverless deploys finally work — but stateful servers will break.
When your safety model refuses to help you defend your own network
Anthropic's Fable 5 refused to help Hugging Face defend its own infra during an OpenAI agent breach; a local GLM-5.2 contained it. The IR lesson: control beats provenance.
Claude Opus 5 benchmarks #1 but its chatty diffs slow my agent loop
Claude Opus 5 tops the Artificial Analysis leaderboard at #1, but its chatty diffs and mid-task questions make it a pain to ship in agent loops.
Claude Opus 5: same price, thinking-on by default, and mostly worth it
Claude Opus 5 keeps Opus 4.8 pricing and genuinely improves multi-file code refactors, but thinking-on by default quietly inflates your token bill 2-3x.
OpenAI's full-duplex voice mode on the ChatGPT desktop app: what holds up and what doesn't
Full-duplex voice on the ChatGPT desktop app nails interruptions but chokes on noise and structured output — here's where it fit my workflow and where it didn't.
Qwen3.8-Max is a 2.4T-param preview — here's what you can't test yet
Qwen3.8-Max is a preview with no weights, no pricing, and no API — the 2.4T parameter count won't tell you what your pipeline actually needs.
Block's Buzz puts AI agents on Nostr with their own keys — here's what actually ships
Block's Buzz makes AI agents full Nostr members with their own keys — but mobile and approval gates aren't shipped yet.
Gemini 3.6 Flash's '17% fewer tokens' claim: what it actually means for your bill
Gemini 3.6 Flash's 17%-fewer-tokens claim only cuts your bill on output-heavy workloads. Here's how to run a real cost-per-task teardown before switching.
Kimi K3 tops the intelligence index and cuts output tokens 21% — does the savings hold?
Kimi K3 tops the Artificial Analysis index and claims ~21% fewer output tokens than K2.6 — but the benchmark savings won't map cleanly to your bill.
I wired MDASH into Defender CLI and GitHub — what it flagged and what it missed
Hands-on with Microsoft's MDASH bug hunter in public preview: what it caught, the logic bugs it missed, and whether the 622-patch headline survives a real repo.
GLM-5.2 is now the open-weight model you benchmark your coding agent against
Z.ai's GLM-5.2 tops mid-July open-weight leaderboards with MIT license, 1M context, and ~91 GPQA — here's what that means for shipping a coding agent.
Gemini 3.5 Pro reportedly restarted pretraining over tool-calling recursion
Gemini 3.5 Pro reportedly restarted pretraining to fix recursive tool-calling — here's what that means for agent loops and what 2M context costs per run.
Grok Build's CLI uploaded your whole Git repo — including committed secrets
Grok Build's CLI uploaded entire Git repos — history and committed secrets — to a GCS bucket. xAI open-sourced the Rust code, but that's not proof it's gone.
Cursor on Windows runs git.exe from a cloned repo with zero clicks
Opening an untrusted repo in Cursor on Windows auto-runs a git.exe planted at the repo root — zero-click RCE. Here's the flaw and what to lock down.
I ran the wire capture on Grok Build CLI. It ships your whole repo, git history and all.
Grok Build CLI v0.2.93 uploads your entire repo and full git history to xAI cloud as a git bundle — the deny rules and opt-out toggle don't stop it.
ChatGPT Work promises hours-long autonomy. Here's what breaks first.
OpenAI's ChatGPT Work promises hours-long task completion, but the real failure mode of long-horizon agents is error accumulation and irreversible actions.
Cloudflare split Search/Agent/Training bot controls are live — and your web-fetching agent just became a target
Cloudflare now blocks AI Agent and Training crawlers by default on ad-supported pages — here's what breaks for anyone shipping a web-fetching agent.
Grok 4.5 in Cursor: the agentic loop holds, the token-speed claim doesn't
Grok 4.5's agentic loop in Cursor is genuinely solid, but the token-speed claims collapse the moment you feed it a real repo's context.
Mistral's next open-weight MoE hits early access — and the specs I actually care about are missing
Mistral's new open-weight MoE hits July early access, but the specs that matter for local use — params, VRAM, quant support — are still undisclosed.
GLM-5.2 is the 'day-to-day coding' open-weight claim — here's what to verify first
GLM-5.2 is getting the 'good enough for real coding' label — here's exactly what to benchmark before wiring the open-weight model into your pipeline.
LongCat-2.0 tops OpenRouter, but the weights aren't out yet
LongCat-2.0 posts SWE-bench Pro 59.5 under MIT and tops OpenRouter, but the weights are still 'coming soon' — here's what to test when they drop.
DeepSeek V4 splits into Pro and Flash: what actually changes in your API calls
DeepSeek's V4 splits into Pro and Flash on a 16T-param open-weight base — here's what breaks in your API calls and which tier is worth the VRAM.
OpenAI's GPT-5.6 'Sol' ships to ~20 gov-approved partners — you get nothing to build on
OpenAI's GPT-5.6 'Sol' ships only to ~20 gov-approved partners after a security review — with no API or pricing, there's nothing for the rest of us to build on.
Claude Sonnet 5 as your default agent runner: what I saw in terminal loops
Claude Sonnet 5 handles terminal and browser agent loops well enough to replace Opus for most tasks — but don't build your budget on the intro pricing.
BioShocking Turns Your Agentic Browser's Reward Loop Into a Credential Leak
BioShocking hijacks an agentic browser's task-reward loop to exfiltrate credentials — here's why prompt guardrails fail and what capability boundary actually stops it.
Cursor's mobile app for coding agents: fine for a nudge, useless for real review
Cursor's mobile app is a solid remote control for starting and nudging a background coding agent — but reviewing real diffs on a phone falls apart.
MiniMax M3 self-hosted: holds up on refactors, chokes on long context
Ran MiniMax M3 locally against Qwen3-Coder and GLM-5.1. Strong on scoped refactors, weak on long context. A solid second model, not a daily driver.
OpenAI vs Anthropic price war: what to actually renegotiate
A price war between OpenAI and Anthropic is good for your bill — but renegotiate, don't migrate. Here's what to ask for and where lock-in bites.
Mistral OCR 4: bounding boxes and confidence scores are the only parts that matter for RAG
OCR 4's bounding boxes, block classification, and confidence scores are the parts that change your RAG pipeline. Tables and chunking are still your problem.
OpenAI's 'Patch the Planet' hands maintainers AI-found CVEs. Who triages them?
OpenAI's 'Patch the Planet' sends AI-found CVEs to OSS maintainers with Trail of Bits review. The whole value lives in the false-positive rate nobody's published.
Agentjacking: your Sentry feed can hand your coding agent a remote shell
Sentry renders error context as markdown. Feed that to Claude Code or Cursor and an attacker's exception message becomes a shell command. Here's what to lock down.
I wired Claude into my CI pipeline — here's what actually broke
Auth took 20 minutes. Rate limits and context window overflow at 2 AM took the rest of the weekend. Here's what I learned wiring Claude into GitHub Actions.
Running Ollama in GitHub Actions CI: What Actually Works
Local LLMs in CI sound great until you hit the 6-hour timeout, runner OOM, and model download bandwidth charges. Here's the setup that survived production.
Fine-Tuning vs Prompting for Intent Classification: A Concrete Comparison
We had 8,000 labeled support intents. I ran the same task through GPT-4o prompting and a fine-tuned distilbert. The answer isn't what the blog posts say.
Prompt Injection Broke Our Customer-Facing Chatbot in Production
A user pasted a competitor's terms-of-service into our support chat. The bot started recommending their product. Here's how we found it and what we changed.
I Benchmarked Three Embedding Models on 50k Support Tickets
text-embedding-3-small, nomic-embed-text, and bge-m3 — same 50k tickets, same retrieval eval. The winner surprised me.