Charles Magno

Grok Bot is the best product I've tested since I started using Claude! Let us know: how are you using your Grok Bot? I'll start: One of my uses is to perform human-like tests in my kliptools websites. With about 3k daily visits, I should try keeping it running with all 58 tools in good shape and it is impossible for me to do this manually. It tests one a time like a human do and give a report in the end. It also found some small errors in the tools descriptions, like when I increased the free quota of one tool and forgot to change that limit in the text. Grok Bot found it without me asking it to look for this.

Gemini 4 Carbon is #1 on "smartest model" but #2 as a coding agent. When you pick a model for real work, what do you trust most: leaderboards, your own test task, or what people say on X? 👇

🎮 Can AI alone make a game that's actually fun? Simon Willison thinks so, and says October 2026 flipped the switch Have you tried building a game with AI? Did you get something playable or just a pretty screen? Tell me 👇 🧠 What he said • According to him, Claude Opus 5.5 got better at 3 things a game needs: 3D models, music and, above all, game design • Before, AI made something that looked like a game. Now, he says, it makes games you actually want to play • The prompt that made the difference: "Make it a LOT more fun" 🕹️ The 4 games • Tree Appreciator: a spot-the-difference game with trees, made in one prompt in regular Claude chat, no Claude Code • Emberwick: a fantasy RPG with a ~15 minute story, a magic system, NPCs and even a level editor • Battle Drones: Command & Conquer style real-time strategy, 2 to 4 player multiplayer, 7 maps, replays and a mode where AI models play each other. Open source (Apache 2.0), and it already has a fork • Quarter Sun Cove: a pumpkin farm sim that Opus 5.5 Ultracode spent almost 2 days building • None took more than 4 hours of his own work (not counting the agent's solo hours) ⚖️ What about GPT-6? • His impression (not an exhaustive study): GPT-6 Astra builds the game, but its sense of fun isn't at Opus 5.5's level yet • He expects OpenAI to catch up by the end of the year 🛠️ How to start, per Simon • Everything in HTML + JavaScript, running in the browser, hosted on GitHub Pages or Cloudflare Pages • Start with "Build a mobile-friendly three.js game where..." on claude.ai or chatgpt.com • Past the testing stage? Move to Claude Code or Codex • Got boring? "Make it a LOT more fun" 📌 Source: @simonw 💡 What does this mean? Games have always been one of the hardest kinds of software: code, art, music, story and design all at once. If AI can deliver that playable and fun with a few hours of direction, think about an app, a tool or a SaaS that solves a real problem. The bottleneck stops being "can I build it?" and becomes "is the idea good, and do I have the eye to polish it?". Games are a great training ground for that, because a bug there doesn't take anyone's business down.

🌐 Google DeepMind just showed Genie 4: you don't watch the video, you walk around inside it Honest question for video creators and game builders: if you could steer a scene in real time instead of re-rendering a clip, would you still make videos the same way? 👇 🎮 What it is • A "world model": it generates a world you move through with the keyboard, live, instead of a fixed clip • You type while it runs to change things: the weather, the camera, add a new person or object • Per Google, Gemini keeps the scene consistent between your inputs, and Gemini Omni grounds how things look and behave 🔊 What's new vs. earlier Genie • First Genie to generate sound natively: wind, waves, ambient noise • Characters that move, react and talk to you in real time, with dialogue that adapts to what you do • Google says physics got a big upgrade too (collisions, aerodynamics) ⏳ Can you use it today? • Not yet. It's a research preview for trusted testers • Next in line, per Google: Google AI Ultra subscribers in Project Genie, plus early-access partners on the Gemini API and Google AI Studio • There's a waitlist on Project Genie 🧑‍💻 Why builders should pay attention • API access means you could plug live, explorable worlds into your own app, not just export an MP4 • Think interactive ads, playable demos, virtual tours, training sims for agents • For video creators, it's a peek at where tools like Flow could go: from "generate a shot" to "direct a scene live" 📌 Source: @GoogleDeepMind 💡 What does this mean? Video gen is turning into world gen. Nobody outside the tester group can try it yet, so watch for API pricing and limits before planning a product around it.

🕵️ Are websites starting to block AI agents in the browser? Something keeps happening to me: some sites stop showing data or ignore clicks while an agent is driving the browser. Yesterday Codex was rotating a GitHub token, and GitHub wouldn't show the new token until I ended Codex's debug session. Then it worked instantly. I don't know if sites actually detect the agent, or if the debug connection itself is what breaks things. Has this happened to you? How do you work around it? 👇

🖥️ OpenAI just shipped GPT-6.1 Terra: an AI that uses your apps, at half the price Would you let an AI click around your apps and fill in forms for you, or is that still a step too far? 👇 📋 What's new • GPT-6.1 Terra reads what's on screen, takes actions across apps and writes more naturally, per OpenAI • On Agents' Last Exam (real work tasks done in software), OpenAI says it matches GPT-6 Astra at one tenth the price per token, and finishes tasks over 3x faster than Astra and GPT-6.1 Sol • At max effort, OpenAI puts its cost per task at roughly 9x lower than Claude Opus 5.5 • 1.05M token context window 💰 Price • API: $1 per million input tokens, $0.05 cached, $5 per million output • Standard API prices are 50% lower than GPT-5.6 Terra and GPT-6.1 Sol, per OpenAI • Batch and Flex are another 50% off 🧑‍💻 What it changes if you're building • Computer use is finally cheap enough for boring, high-volume jobs: reading invoices and typing them into accounting software, filling forms, moving data between tools that have no API • In ChatGPT Work and Codex (Plus, Pro, Enterprise, Edu), your usage allowance stretches further than with Sol or Astra • OpenAI itself says that for deep research or complex coding you should still pick GPT-6.1 Sol or GPT-6 Astra. So this one is for the doing, not the heavy thinking 📌 Source: @OpenAI 💡 What does this mean? The price of an agent that actually operates software just dropped hard. If part of your product (or your week) is someone copying data from one screen to another, that's the first thing worth testing.

🔐 Gemini API now saves your prompts and responses by default (new projects) Quick question for anyone shipping on Gemini: do you actually know what your AI provider keeps from your users' conversations? 👇 📋 What changed • From Oct 26, new paid-tier projects using generateContent, streamGenerateContent and batchGenerateContent store requests by default (store=true), per Google • That's the full prompt, the response and previous-turn context, viewable in the Logs and Datasets dashboard • Logs expire after 55 days by default; you can set 7, 14, 28 or 55. Anything saved to a dataset doesn't expire • Existing projects keep their current setting 🛠️ How to turn it off • Send store=false on each request, or • Turn off Generate Content API logging in the Settings panel of Logs and Datasets 🧑‍💻 Why it matters if you're building a product • If your app handles customer data (support chats, phone transcripts, health or finance info), that text now sits in your Google project by default • Great for debugging and building eval sets from real traffic • Not great if your privacy policy says you don't keep user data. Check before you spin up a new project 📌 Source: Gemini API changelog (Google) 💡 What does this mean? Free debugging logs are handy, but "on by default" means you decide on purpose. Create a new project, check that setting first, then ship.

📝 Google Docs now opens and edits .md files natively, no conversion Are you still copying your PRD or CLAUDE.md into Docs just so your team can comment? Tell me how you handle it 👇 🔧 What changed • Per Google, you can open, edit and collaborate on markdown (.md) files natively in Google Docs • The file stays a .md, with a ".md" badge at the top so you know • In Drive you see rendered markdown (tables, links) and switch to plain text in one click • Comments, suggestions and version history work like any doc 🤖 Built for humans and agents • Google says people and AI agents can co-edit the same file in real time • Version history tracks everyone's changes, human and agent • Per Google, markdown use in Drive grew a lot over the past year, driven by LLMs 🚀 What it means if you build products • Specs, PRDs, READMEs and agent instruction files live where a partner or client can read and comment without installing anything • Download the .md back and it still works in your repo and your coding agent • Available to anyone with a Google or Workspace account: just upload a .md to Drive 💡 What does this mean? Markdown has become the shared language between us and AI. The easier it is to review what your agent will follow, the better the real app it ships, and now that review happens somewhere everyone already uses. 📌 Source: Google Developers Blog

📈 Anthropic just filed to go public, and the S-1 is basically a Claude Code story Would you buy $ANT on day one, or does going public change how you see the company behind your coding agent? 👇 📋 What was filed • Anthropic filed its S-1 with the SEC today to list on Nasdaq under the ticker "ANT" • Share count and price range aren't set yet 💰 The numbers in the filing • Revenue: $41M (2023), $386M (2024), $4.6B (2025) • First half of 2026: $16.3B, up from $1.2B in the same period of 2025 • Operating loss shrank to $693M in H1 2026, from $2.1B a year earlier • About 5,300 employees as of Sept 30, 2026 • 1,900+ customers paying $1M+ a year, and about 250 paying $10M+ 🧑‍💻 Where Claude Code fits • The filing calls Claude Code "the clearest manifestation" of what it calls Virtual Collaborators: AI that plans, writes, tests and debugs on its own • Anthropic says its launch was comparable in impact to the first widely used chat assistants 📌 Source: @AnthropicAI 💡 What does this mean? Writing code with an agent is now the core of a company heading to Nasdaq. For anyone building alone, that's a strong sign these tools will keep getting better and stick around. A solo dev with a good agent can ship a real, paying product, and the big money is betting on exactly that.

🛡️ "Faça uma auditoria completa de segurança deste servidor": o @levelsio passou um dia inteiro digitando isso no Claude Code Quando foi a última vez que você pediu pro seu agente de IA auditar o seu próprio servidor? Conta a verdade aqui embaixo 👇 🧑‍💻 O que ele fez • Segundo o @levelsio, ele rodou esse mesmo prompt no Claude Code em cada VPS e em cada site que tem • Ele já tinha atualizações automáticas de segurança no Ubuntu, com reboot automático (segundo ele, o reboot leva uns 4 minutos) • Cada VPS fica isolado no Tailscale com regras de segurança geradas pelo próprio Claude Code, então um servidor invadido não alcança os outros, nem o MacBook ou o iPhone dele • Os serviços web rodam como www-data, pra evitar acesso root ⚠️ Por que agora • Ele estava citando o @sobedominik, que contou que uma das empresas dele sofreu um ataque hacker feito por IA "diferente de tudo que já vi" • A proposta dele: uma "semana de segurança" por mês, ao lado da "semana de marketing" do @yongfook, porque com os modelos ficando melhores, a defesa também precisa melhorar • A aposta dele: a IA parece ser mais ou menos tão boa atacando quanto defendendo, então, se a gente continuar pedindo auditoria com frequência, dá pra se manter seguro 🔧 O que funcionou pra mim • Hospedo meus projetos em VPS próprios (a Contabo é um dos provedores) com Docker Compose, e todo container segue o mesmo modelo: limite de CPU e memória, usuário sem root, portas só locais e healthcheck • O painel de admin fica atrás de um túnel com login restrito, nunca aberto pra internet • Backup criptografado copiado pra fora do servidor, e eu testo a restauração de verdade • Monitor de uptime que me avisa quando alguma coisa cai 💡 O que isso significa? A IA permite que uma pessoa sozinha construa e mantenha produtos reais, funcionando, nos próprios servidores. O outro lado é que os mesmos modelos poderosos deixam os ataques mais baratos e mais rápidos. Um prompt de auditoria por mês custa uma tarde. Ser invadido custa bem mais. Coloca na agenda. 📌 Fonte: @levelsio

🛡️ "Do a full security audit of this server": @levelsio spent a whole day typing this into Claude Code When was the last time you asked your AI agent to audit your own server? Be honest below 👇 🧑‍💻 What he did • According to @levelsio, he ran that one prompt in Claude Code on every VPS and every site he has • He already had unattended security upgrades in Ubuntu with automatic reboot (he says a reboot takes about 4 minutes) • Each VPS is isolated on Tailscale with security policies generated by Claude Code itself, so a hacked server can't reach the others, or his MacBook and iPhone • Web services run under www-data, to avoid root access ⚠️ Why now • He was quoting @sobedominik, who wrote that one of his companies was hit by an AI-driven cyber attack "unlike anything I've ever seen before" • His proposal: one "security week" per month, next to @yongfook's "marketing week", because as models get better, our defense has to get better too • His bet: AI attack and defense capabilities seem to roughly match, so if we keep asking for audits regularly, we can stay safe 🔧 What worked for me • I self-host my projects on VPS servers (Contabo is one of my providers) with Docker Compose, and every container follows the same template: CPU and memory limits, non-root user, local-only ports, healthcheck • The admin panel sits behind a tunnel with restricted login, never open to the internet • Encrypted backups copied off the server, and I actually test the restore • Uptime monitoring that alerts me when something goes down 💡 What does this mean? AI lets one person build and run real, working products on their own servers. The flip side is that the same models make attacks cheaper and faster. A monthly audit prompt costs you an afternoon. Getting hacked costs a lot more. Put it on the calendar. 📌 Source: @levelsio

Você precisa lançar um produto neste fim de semana com um modelo só. Opus, GPT, Gemini ou um aberto como o Kimi? Qual e por quê? 👇

You have to ship a product this weekend with only one model. Opus, GPT, Gemini or an open one like Kimi? Which and why? 👇

Sinceridade: qual foi a última coisa que seu agente de IA quebrou e você só descobriu em produção? 👇

Be honest: what's the last thing your AI agent broke that you only caught in production? 👇

PHP, depois Ruby, agora o Brotli dentro do Node. Com que frequência você atualiza suas dependências de verdade: toda semana, todo mês ou só quando quebra? 👇

PHP, then Ruby, now Brotli inside Node. How often do you really update your dependencies: weekly, monthly, or only when something breaks? 👇

🔓 Falha no Brotli: um arquivo comprimido malicioso pode tomar seu servidor Node, Bun ou Envoy Quando foi a última vez que você atualizou de verdade o Node do seu servidor? Seja sincero nos comentários 👇 🚨 O que aconteceu • Segundo a OpenAI, os agentes de red team dela acharam uma falha de execução remota de código, sem autenticação, no Brotli, a biblioteca de compressão que vem dentro do Node.js, do Bun e do Envoy • Não precisa nem de conta: um servidor sem patch que aceita dados comprimidos pode ser tomado por um cliente malicioso, e um cliente como o "curl --compressed" pode ser tomado por um servidor malicioso • A causa já tinha sido corrigida no código do Brotli em fevereiro, mas ninguém sabia que era brecha de segurança e não saiu versão nova • Agora ela tem registro oficial: CVE-2026-111497 🩹 Versões corrigidas (segundo o patchtheplanet.org) • Node.js: 22.23.4, 24.22.1 ou 26.12.1 • Bun: 1.4.4 • Envoy: 1.40.0, 1.39.3, 1.38.6 ou 1.37.8 • Istio: 1.29.9, 1.30.6 ou 1.31.2 • O próprio Brotli: 1.0.10, 1.1.1 ou 1.2.1 🧰 Não dá pra atualizar hoje? • Recuse requisições com "Content-Encoding: br" antes de qualquer parser rodar, e mantenha gzip e deflate • No Next.js, ativar images.unoptimized impede o otimizador de imagens de baixar e descomprimir imagens remotas até o Node ser atualizado • Desligar o Brotli no CDN não resolve: o problema está em descomprimir, não em comprimir 🔁 Não esqueça de reiniciar • Atualize as versões fixadas nas imagens, refaça os containers e suba de novo cada serviço, worker e cron que ainda roda o build antigo • Apps em Electron e ferramentas que embutem o Node podem ter a própria cópia do Brotli 💡 O que isso significa? Um dia é PHP, no outro é Ruby, agora uma biblioteca escondida dentro do runtime. Os agentes de IA estão achando bug antigo mais rápido do que nunca, então atualizar virou hábito semanal, não tarefa de fim de ano. Pra quem constrói sozinho, ganha quem consegue refazer e subir tudo em minutos. Fixe as versões, saiba o que está exposto na internet e tenha a lista de todo lugar onde seu runtime está rodando. 📌 Fonte: @OpenAI

🔓 Brotli bug: a malicious compressed file can take over your Node, Bun or Envoy server When was the last time you actually updated Node on your server? Be honest in the comments 👇 🚨 What happened • According to OpenAI, its red-teaming agents found an unauthenticated remote code execution flaw in Brotli, the compression library built into Node.js, Bun and Envoy • No user account needed: an unpatched server that accepts compressed input can be taken over by a malicious client, and a client like "curl --compressed" can be taken over by a malicious server • The root cause was fixed in Brotli's source back in February, but nobody knew it was a security hole and there was no new release • It's now tracked as CVE-2026-111497 🩹 Fixed versions (according to patchtheplanet.org) • Node.js: 22.23.4, 24.22.1 or 26.12.1 • Bun: 1.4.4 • Envoy: 1.40.0, 1.39.3, 1.38.6 or 1.37.8 • Istio: 1.29.9, 1.30.6 or 1.31.2 • Brotli itself: 1.0.10, 1.1.1 or 1.2.1 🧰 Can't patch today? • Reject requests with "Content-Encoding: br" before any body parser runs, and keep gzip and deflate • On Next.js, setting images.unoptimized stops the built-in image optimizer from fetching and decoding remote images until Node is updated • Turning off Brotli on your CDN doesn't cover this: it's about decompressing, not compressing 🔁 Don't forget the restart • Update the image pins, rebuild the containers and redeploy every service, worker and cron job still running the old build • Electron apps and tools that bundle Node can carry their own copy of Brotli 💡 What does this mean? PHP one day, Ruby the next, now a library hidden inside your runtime. AI agents are finding old bugs faster than ever, so patching is becoming a weekly habit, not a yearly chore. For a solo builder, the setup that wins is the one you can rebuild and redeploy in minutes. Pin your versions, know what's exposed to the internet, and keep a list of every place your runtime is running. 📌 Source: @OpenAI

O checklist de 12 passos que eu usaria pra sair de Vercel + Supabase nesse fim de semana: • faça o inventário de tudo • proteja a VPS antes de qualquer coisa • pg_dump, restore, confere as linhas • gire todas as chaves no final Lista completa no artigo (salva aí).

The 12-step checklist I'd use to leave Vercel + Supabase this weekend: • inventory everything • harden the VPS first • pg_dump, restore, count rows • rotate every key at the end Full list in the article (bookmark it).